chore(deps): bump the production-dependencies group across 1 directory with 4 updates

[dependabot]

Bumps the production-dependencies group with 4 updates in the /app directory: better-sqlite3, jose, node-llama-cpp and tesseract.js.

Updates better-sqlite3 from 13.0.1 to 13.0.3

Release notes

Sourced from better-sqlite3's releases.

v13.0.3

What's Changed

• use Ubuntu 22.04-arm by @​neoxpert in WiseLibs/better-sqlite3#1510

Full Changelog: WiseLibs/better-sqlite3@v13.0.2...v13.0.3

v13.0.2

What's Changed

• add gypfile option to package.json by @​neoxpert in WiseLibs/better-sqlite3#1505
• Update SQLite to version 3.53.4 by @​JoshuaWise in WiseLibs/better-sqlite3#1506
• validate the parameters of table properly by @​theosotr in WiseLibs/better-sqlite3#1504
• fix: this dependabot configuration does not set a co... in... by @​anupamme in WiseLibs/better-sqlite3#1508
• fixed process aborting from terminating worker threads (WiseLibs/better-sqlite3#1507)

New Contributors

• @​theosotr made their first contribution in WiseLibs/better-sqlite3#1504
• @​anupamme made their first contribution in WiseLibs/better-sqlite3#1508

Full Changelog: WiseLibs/better-sqlite3@v13.0.1...v13.0.2

Commits

• dbc2ea1 13.0.3
• b872585 use Ubuntu 22.04-arm (#1510)
• 569e85a 13.0.2
• df1324b fix: this dependabot configuration does not set a co... in... (#1508)
• b9fbe5f fixed segfault from making calls while worker thread is terminating
• 71707c4 validate the parameters of table properly (#1504)
• 6478c99 Update SQLite to version 3.53.4 (#1506)
• 6d24034 add gypfile option to package.json (#1505)
• ab6232e fixed typo in docs
• 57d751c updated readme
• See full diff in compare view

Updates jose from 5.10.0 to 6.2.10

Release notes

Sourced from jose's releases.

v6.2.10

Fixes

• jose: consume serialization members once (9bee285)
• jose: reject empty protected and JWE AAD members (8da4145)
• jose: validate serialized header values (b711d8f)
• jwe: conceal invalid decrypted CEK lengths (41fafe0)
• jwe: enforce AES-GCM tag boundaries (9a5b744)
• jwe: validate explicit encryption parameters (7a02697)
• jwk: accept empty octet-sequence keys (3f871e7)
• jwk: normalize key resolution inputs (f54ee7b)
• jwks: enforce verification key metadata (f9ba510)
• jwks: order overlapping remote reloads (9a1a913)
• jwks: reject invalid remote duration values (7bdb9e5)
• jwk: validate ext and key_ops parameters (4d91c37)
• jws: reject mixed payload encoding modes (dc69713)
• jws: validate unencoded payload strings (541f282)
• jwt: enforce explicit verification policies (b347182)
• jwt: prevent replacing protected headers (ae07d09)
• jwt: reject invalid duration inputs (282f9aa)
• jwt: validate builder claim values (ea03f83)
• jwt: validate unsecured protected headers (230c14e)
• key: validate generation and import options (15d880e)
• reject mixed b64 modes for empty General JWS payloads (61a2ef7)
• x509: reject DER truncated past its outer length (d8db9f6)

Documentation

• jwks: correct cache timestamp units (01a44d9)

Refactor

• jose: share binary input validation (eedb124)
• jose: share compact token processing internals (85e30ed)
• jwe: consolidate CBC decryption failures (1ee6f61)
• jwe: specialize compact processing (a998927)
• jwe: streamline single-recipient encryption (290aaa6)
• jwks: compact JWK Set shape validation (930c7df), references Array#every
• jwks: compact local key selection (4cb5ae5)
• jwks: compact remote resolver state (ef5eaf4)
• jws: specialize compact processing (021abf4)
• jwt: compact claim validation helpers (f390683)
• jwt: consolidate replicated claim checks (7dd5591)
• jwt: share producer claim state (52ba159)
• key: compact JWK algorithm selection (a6b29da)
• key: compact secret length parsing (cc03be8)

v6.2.9

Fixes

... (truncated)

Changelog

Sourced from jose's changelog.

6.2.10 (2026-08-21)

Fixes

• jose: consume serialization members once (9bee285)
• jose: reject empty protected and JWE AAD members (8da4145)
• jose: validate serialized header values (b711d8f)
• jwe: conceal invalid decrypted CEK lengths (41fafe0)
• jwe: enforce AES-GCM tag boundaries (9a5b744)
• jwe: validate explicit encryption parameters (7a02697)
• jwk: accept empty octet-sequence keys (3f871e7)
• jwk: normalize key resolution inputs (f54ee7b)
• jwks: enforce verification key metadata (f9ba510)
• jwks: order overlapping remote reloads (9a1a913)
• jwks: reject invalid remote duration values (7bdb9e5)
• jwk: validate ext and key_ops parameters (4d91c37)
• jws: reject mixed payload encoding modes (dc69713)
• jws: validate unencoded payload strings (541f282)
• jwt: enforce explicit verification policies (b347182)
• jwt: prevent replacing protected headers (ae07d09)
• jwt: reject invalid duration inputs (282f9aa)
• jwt: validate builder claim values (ea03f83)
• jwt: validate unsecured protected headers (230c14e)
• key: validate generation and import options (15d880e)
• reject mixed b64 modes for empty General JWS payloads (61a2ef7)
• x509: reject DER truncated past its outer length (d8db9f6)

Documentation

• jwks: correct cache timestamp units (01a44d9)

Refactor

• jose: share binary input validation (eedb124)
• jose: share compact token processing internals (85e30ed)
• jwe: consolidate CBC decryption failures (1ee6f61)
• jwe: specialize compact processing (a998927)
• jwe: streamline single-recipient encryption (290aaa6)
• jwks: compact JWK Set shape validation (930c7df), references Array#every
• jwks: compact local key selection (4cb5ae5)
• jwks: compact remote resolver state (ef5eaf4)
• jws: specialize compact processing (021abf4)
• jwt: compact claim validation helpers (f390683)
• jwt: consolidate replicated claim checks (7dd5591)
• jwt: share producer claim state (52ba159)
• key: compact JWK algorithm selection (a6b29da)
• key: compact secret length parsing (cc03be8)

6.2.9 (2026-08-15)

... (truncated)

Commits

• 3eab152 chore(release): 6.2.10
• 021abf4 refactor(jws): specialize compact processing
• a998927 refactor(jwe): specialize compact processing
• eedb124 refactor(jose): share binary input validation
• 52ba159 refactor(jwt): share producer claim state
• 85e30ed refactor(jose): share compact token processing internals
• 0bd81d2 test(jose): cover hidden critical-header options
• 9cf7876 test(jose): reject callable object impostors
• f23cafd test(jose): preserve resolved key data properties
• 1ee6f61 refactor(jwe): consolidate CBC decryption failures
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for jose since your current version.

Updates node-llama-cpp from 3.19.1 to 3.20.0

Release notes

Sourced from node-llama-cpp's releases.

v3.20.0

3.20.0 (2026-08-11)

Features

• Muse Glimmer support (#639) (adb92f2)
• improve thought segments syntax extraction (#636) (3f686d7)
• expose download speed and ETA for a model downloader (#636) (3f686d7)
• expose the model's architecture directly on the model instance (#636) (3f686d7)
• inspect gpu command: print model parameters count (#639) (adb92f2)

Bug Fixes

• adapt to breaking llama.cpp changes (#636) (3f686d7)
• LlamaContextSequence: make .dispose() return a promise (#636) (3f686d7)
• Qwen chat wrapper auto thought segment opening (#636) (3f686d7)
• optimize checkpoints with auto opening thought segments (#636) (3f686d7)
• simulator model dispose while in use race conditions (#636) (3f686d7)
• Vulkan device memory readings (#636) (3f686d7)
• topP config when using temperature (#639) (adb92f2)
• support more quant labels (#639) (adb92f2)

---

Shipped with llama.cpp release b10361

To use the latest llama.cpp release available, run npx -n node-llama-cpp source download --release latest. (learn more)

Commits

• adb92f2 feat: Muse Glimmer support (#639)
• 3f686d7 feat: improve thought segments syntax extraction (#636)
• See full diff in compare view

Updates tesseract.js from 5.1.1 to 7.0.0

Release notes

Sourced from tesseract.js's releases.

v7.0.0

What's Changed

• Significant improvements to recognition speed (by @​fanchenkong1 in naptha/tesseract.js#1039)
  • A new relaxedsimd build takes advantage of the latest WASM and hardware capabilities.
  • Upgrading from v6 to v7 reduces runtimes by ~15-35% (depending on device and use-case). The highest uplifts are currently seen on the latest Intel processors.
• Dropped support for Node.js v14.
• Various minor changes

New Contributors

• @​hata6502 made their first contribution in naptha/tesseract.js#1035
• @​fanchenkong1 made their first contribution in naptha/tesseract.js#1039

Full Changelog: naptha/tesseract.js@v6.0.1...v7.0.0

v6.0.1

What's Changed

• Switched from using node-fetch to using built-in fetch implementation for Node.js v18 and newer.
  • This resolves a nuisance dependency-related warning message reported in #876
• Various minor updates

Full Changelog: naptha/tesseract.js@v6.0.0...v6.0.1

v6.0.0

What's Changed

• Fixed memory leaks (#977)
  • This version fixed a long-standing issue where memory would rise over time, eventually leading to a crash.
• Reduced runtime and memory usage for most users by updating default formats (#916).
• Fixed compatibility with Electron main process (#925)
• Fixed bug where user-provided parameters were overwritten by defaults (#975).

Breaking Changes

1. All outputs formats other than text are now disabled by default.
   • To re-enable the hocr output (for example), set the following: worker.recognize(image, {}, { hocr: true })
     • See here for a list of possible output formats.
2. The JavaScript object output format (blocks) was tweaked.
   • Only the array of blocks (blocks) is returned.
     • Previous versions would automatically generate lists of every unit of text (words, symbols, etc.).
       • If needed, these should now be generated by the user.
   • Only text-based blocks are reported.
     • Previous versions reported non-text blocks when detected by Tesseract (e.g. line segments).
   • The shape of some objects were changed.
     • See the type declarations for reference on properties.
     • The main properties--text and bbox--are unchanged.
3. Various functions and options marked as depreciated previously have been removed.
   1. This includes worker.initialize and worker.loadLanguage, along with several depreciated options from v2.

See #993 for additional discussion about this release.

New Contributors

... (truncated)

Commits

• 42eae66 7.0.0
• 1b0faec Enable WASM relaxed SIMD in tesseract.js (#1039)
• 4144941 Dropped Node.js v14 support (#1041)
• 50a3fd2 Added Node.js v24 to Actions (#1021)
• a20d9ff Bump form-data from 4.0.2 to 4.0.4 (#1026)
• 0676b78 Bump tmp from 0.2.3 to 0.2.4 (#1029)
• 9c6fc3c Fixed types per #1033 (#1036)
• fb2bd4d Add GIF format to documentation (#1035)
• d82eb05 Fixed type error per #1031 (#1032)
• f9dac07 Update api.md
• Additional commits viewable in compare view

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.