chore(deps): bump the production-dependencies group with 12 updates

[dependabot]

Bumps the production-dependencies group with 12 updates:

Package	From	To
@quartz-community/bases-page	0.2.0	0.2.2
@quartz-community/crawl-links	0.1.0	0.1.1
@quartz-community/encrypted-pages	0.1.0	0.1.1
@quartz-community/footer	0.1.0	0.1.1
@quartz-community/obsidian-flavored-markdown	0.1.1	0.1.2
@quartz-community/og-image	0.1.1	0.1.2
isomorphic-git	1.38.9	1.40.0
minimatch	10.2.5	10.2.6
yargs	18.0.0	18.1.0
@quartz-community/types	0.2.1	0.3.0
@quartz-community/utils	0.1.0	0.1.1
@types/node	26.1.1	26.1.2

Updates @quartz-community/bases-page from 0.2.0 to 0.2.2

Release notes

Sourced from @​quartz-community/bases-page's releases.

v0.2.2

Patch Changes

• 0728d19: Fix transclusion of base views with spaces in the name. The OFM plugin slugifies the fragment (e.g., French Philosophers → french-philosophers) but the view lookup expected the original name. View matching now normalizes both sides by lowercasing and replacing spaces with hyphens.

v0.2.1

Patch Changes

• 2858f17: Fix mixed-case tags not matching in bases filters. Tags are slugified during content processing but the filter comparison did not normalize case, causing file.tags.contains("My-Tag") to fail when the stored tag was "my-tag".

  Add MMM (abbreviated month name) and MMMM (full month name) tokens to the date format() function. Previously these tokens were not recognized, causing file.ctime.format("MMM") to return the raw token string instead of month names like "Jan" or "January".

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog and this project adheres to Semantic Versioning.

Changelog

Sourced from @​quartz-community/bases-page's changelog.

0.2.2

Patch Changes

• 0728d19: Fix transclusion of base views with spaces in the name. The OFM plugin slugifies the fragment (e.g., French Philosophers → french-philosophers) but the view lookup expected the original name. View matching now normalizes both sides by lowercasing and replacing spaces with hyphens.

0.2.1

Patch Changes

• 2858f17: Fix mixed-case tags not matching in bases filters. Tags are slugified during content processing but the filter comparison did not normalize case, causing file.tags.contains("My-Tag") to fail when the stored tag was "my-tag".

  Add MMM (abbreviated month name) and MMMM (full month name) tokens to the date format() function. Previously these tokens were not recognized, causing file.ctime.format("MMM") to return the raw token string instead of month names like "Jan" or "January".

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog and this project adheres to Semantic Versioning.

[Unreleased]

Added

• options field on ViewTypeRegistration — community plugins can pass user-supplied configuration (e.g. feature flags) that gets forwarded to every render invocation via ViewRendererProps.options.
• options field on ViewRendererProps — view renderers receive registration-time options as Record<string, unknown>.
• slug, allSlugs, and linkResolution fields on ViewRendererProps — view renderers can now resolve internal links correctly.
• css and afterDOMLoaded fields on ViewTypeRegistration — community view types can inject per-page styles and client-side scripts.
• linkResolution plugin option ("absolute" | "relative" | "shortest") — controls how internal links are resolved in view renderers, matching the crawl-links plugin setting.

Fixed

• Added yaml and unist-util-visit to devDependencies (were listed as peer dependencies but missing from devDependencies, causing tsc --noEmit failures).
• Respect the file.data.unlisted convention in resolveBasesEntries. Pages marked unlisted: true are now excluded from every rendered base view (table, list, board, cards, gallery, and any custom view registered via viewRegistry), regardless of whether the base's filter expression would otherwise match them. Fixes a privacy leak where encrypted-unlisted and plain-unlisted pages showed up in base views built from queries like file.ext == "md" that matched the entire content directory. Both the main entry loop and the internal fileLookup used by .asFile() method resolution are filtered, so unlisted pages also cannot be dereferenced from formulas on visible pages. The convention is the same one respected by content-index, search, backlinks, recent-notes, folder-page, and tag-page, and is written by @quartz-community/unlisted-pages and @quartz-community/encrypted-pages (when unlistWhenEncrypted or per-page unlisted: true/stealth: true is set).

Commits

• db114af Merge pull request #6 from quartz-community/changeset-release/main
• 69f0dd2 chore: version package
• 0728d19 fix: normalize view name matching for transclusion with spaces (#1)
• 3b11fb8 fix(ci): add NODE_AUTH_TOKEN for npm publish
• dd22ced Merge pull request #5 from quartz-community/changeset-release/main
• 5284582 chore: version package
• 2858f17 chore: add changeset for patch release
• e0b2da4 fix: normalize tag case in list.contains for bases filters (#2468)
• c2c8d14 fix: use changesets/action@v1 (v2 is prerelease)
• f7aca08 chore: add changesets release workflow
• Additional commits viewable in compare view

Attestation changes

This version has no provenance attestation, while the previous version (0.2.0) was attested. Review the package versions before updating.

Updates @quartz-community/crawl-links from 0.1.0 to 0.1.1

Release notes

Sourced from @​quartz-community/crawl-links's releases.

v0.1.1

Patch Changes

• c8a04da: Fix prettyLinks truncating explicit wikilink aliases that contain a slash. Previously path.basename() was applied to all link text, turning an alias like Part 1/Part 2 into just Part 2. prettyLinks now skips links that have an explicit alias.

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog and this project adheres to Semantic Versioning.

Changelog

Sourced from @​quartz-community/crawl-links's changelog.

0.1.1

Patch Changes

• c8a04da: Fix prettyLinks truncating explicit wikilink aliases that contain a slash. Previously path.basename() was applied to all link text, turning an alias like Part 1/Part 2 into just Part 2. prettyLinks now skips links that have an explicit alias.

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog and this project adheres to Semantic Versioning.

[Unreleased]

Added

• Initial Quartz community plugin template.
• disableBrokenWikilinks option: when enabled, internal links whose resolved slug is not present in ctx.allSlugs gain a broken CSS class alongside internal so broken links can be styled distinctly. The check lives here (rather than in ObsidianFlavoredMarkdown) because this plugin owns link resolution and already computes the canonical slug.

Changed

• BREAKING (inherited from @quartz-community/utils): internal link resolution is now case-insensitive. Links resolve to lowercased slugs regardless of how they're typed ([[MyNote]], [[mynote]], [[MYNOTE]] all produce href my-note). Matches Obsidian's link-matching behavior.

Commits

• 2673605 Merge pull request #5 from quartz-community/changeset-release/main
• 201b036 chore: version package
• c8a04da fix: skip prettyLinks on explicit aliases to preserve slashes (#1)
• 467a98e fix(ci): add NODE_AUTH_TOKEN for npm publish
• 469a6f3 fix: use changesets/action@v1 (v2 is prerelease)
• 62aff80 chore: add changesets release workflow
• 7dc7597 chore: migrate to npm publishing
• See full diff in compare view

Attestation changes

This version has no provenance attestation, while the previous version (0.1.0) was attested. Review the package versions before updating.

Updates @quartz-community/encrypted-pages from 0.1.0 to 0.1.1

Release notes

Sourced from @​quartz-community/encrypted-pages's releases.

v0.1.1

Patch Changes

• 793ae9e: Remove stale defaultPosition: "body" from component manifest and outdated layout reference from README.

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog and this project adheres to Semantic Versioning.

Changelog

Sourced from @​quartz-community/encrypted-pages's changelog.

0.1.1

Patch Changes

• 793ae9e: Remove stale defaultPosition: "body" from component manifest and outdated layout reference from README.

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog and this project adheres to Semantic Versioning.

[Unreleased]

Added

• EncryptedContentIndex emitter that writes a versioned shadow content index (static/encryptedContentIndex.json) containing opaque encrypted blobs of per-page metadata (slug, title, links, tags) for pages marked unlisted: true. The shadow index uses a flat array format so no slugs or titles leak to anonymous visitors.
• unlistWhenEncrypted option on the EncryptedPages transformer. When true, encrypted pages are marked file.data.unlisted = true, hiding them from every build-time listing surface that respects the unlisted convention (contentIndex, RSS, sitemap, backlinks, recent-notes, folder-page, tag-page, graph, explorer, search) while still emitting the HTML so the page remains accessible by direct URL.
• Per-page unlisted: true | false frontmatter override. Explicit unlisted: false forces the page listed even when unlistWhenEncrypted is set.
• Per-page stealth: true frontmatter field. Stealth pages are encrypted pages that are hidden from every listing surface permanently, even after a successful client-side decryption — their metadata is never written to the shadow content index, so there is nothing for the client to recover. Useful for "secret door" pages that should only be accessible to users who already know the exact URL. stealth: true implies unlisted: true and overrides any explicit unlisted: false. No effect on non-encrypted pages.
• Client-side shadow-index unlocking: on every page load with cached passwords, the client script fetches the shadow index, decrypts entries with cached passwords, patches the resolved fetchData object in place, and dispatches content-index-updated so graph, explorer, and search re-initialize with the unlocked pages.
• encryptAesGcm, decrypt, and SHADOW_INDEX_VERSION exports for test and extension use.
• ShadowIndexBlob, ShadowIndexFile, and ShadowContentIndexEntry type exports.
• EncryptedContentIndexOptions.passwordField (default "password") so the emitter reads the frontmatter password field from its own merged options rather than spelunking ctx.cfg.plugins.transformers at emit time.
• outputPath field in the package manifest's defaultOptions and optionSchema so users can override the shadow-index output path from quartz.config.yaml.

Fixed

• Shadow content index emitter now actually runs. Changed package.json > quartz.category from "transformer" to ["transformer", "emitter"] so Quartz v5's plugin loader instantiates both the transformer and the emitter from the single config entry. Previously, Quartz read "transformer" and only ever called findFactory(module, "transformer"), so EncryptedContentIndex was exported from the module but never invoked — static/encryptedContentIndex.json was never written. A user's single - source: github:quartz-community/encrypted-pages entry in quartz.config.yaml now correctly produces both the transformer and the emitter instances, and both factories receive the same merged options object.

Removed

• Breaking: EncryptedPageFilter. It used Quartz's shouldPublish filter mechanism, which removes pages from the entire build (no HTML emitted), directly contradicting the plugin's own README. Use unlistWhenEncrypted: true or per-page unlisted: true frontmatter instead.
• Breaking: visibility option on the EncryptedPages transformer. It set a file.data.encryptedVisibility flag that nothing in the Quartz v5 ecosystem read — the option had no effect.
• Breaking: EncryptedPagesOptions.visibility type field.
• Breaking: EncryptedPageFilterOptions type export.
• The build-time warning for a missing EncryptedContentIndex emitter. Quartz v5's plugin loader now instantiates both the transformer and the emitter automatically from the same config entry (via the category: ["transformer", "emitter"] manifest), so the warning is obsolete.

Changed

• Plugin ordering requirement: EncryptedPages must run after CrawlLinks (or any other transformer that populates file.data.links) in the htmlPlugins chain. Use the order field in quartz.config.yaml to control this. Documented in README.
• The README no longer instructs users to register the emitter separately — Quartz v5 handles that automatically from a single config entry.

Commits

• 6df5732 Merge pull request #1 from quartz-community/changeset-release/main
• 1de4e00 chore: version package
• 793ae9e chore: add changeset for stale position removal
• d9a8723 fix: remove stale defaultPosition and layout reference
• 13c776d fix(ci): add NODE_AUTH_TOKEN for npm publish
• 347995b fix: use changesets/action@v1 (v2 is prerelease)
• 0935b84 chore: add changesets release workflow
• 8dac96a chore: migrate to npm publishing
• See full diff in compare view

Attestation changes

This version has no provenance attestation, while the previous version (0.1.0) was attested. Review the package versions before updating.

Updates @quartz-community/footer from 0.1.0 to 0.1.1

Release notes

Sourced from @​quartz-community/footer's releases.

v0.1.1

Patch Changes

• 76bb311: Add layout position documentation to README.

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog and this project adheres to Semantic Versioning.

Changelog

Sourced from @​quartz-community/footer's changelog.

0.1.1

Patch Changes

• 76bb311: Add layout position documentation to README.

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog and this project adheres to Semantic Versioning.

[Unreleased]

Added

• Initial Quartz community plugin template.

Commits

• 1706842 Merge pull request #1 from quartz-community/changeset-release/main
• b896104 chore: version package
• 76bb311 chore: add changeset for layout position docs
• 2e98a98 docs: add layout position documentation to README
• 329ed39 fix(ci): add NODE_AUTH_TOKEN for npm publish
• da17e19 fix: use changesets/action@v1 (v2 is prerelease)
• 743c84a chore: add changesets release workflow
• 03cce88 chore: migrate to npm publishing
• See full diff in compare view

Attestation changes

This version has no provenance attestation, while the previous version (0.1.0) was attested. Review the package versions before updating.

Updates @quartz-community/obsidian-flavored-markdown from 0.1.1 to 0.1.2

Release notes

Sourced from @​quartz-community/obsidian-flavored-markdown's releases.

v0.1.2

Patch Changes

• f9cf161: Fix nested callout body text leaking into the title when the body contains bold/italic formatting. Previously, inline nodes (e.g., **bold**) following a newline in a nested blockquote callout were incorrectly included in the callout title instead of the callout content.

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog and this project adheres to Semantic Versioning.

Changelog

Sourced from @​quartz-community/obsidian-flavored-markdown's changelog.

0.1.2

Patch Changes

• f9cf161: Fix nested callout body text leaking into the title when the body contains bold/italic formatting. Previously, inline nodes (e.g., **bold**) following a newline in a nested blockquote callout were incorrectly included in the callout title instead of the callout content.

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog and this project adheres to Semantic Versioning.

[Unreleased]

Added

• Initial Quartz community plugin template.

Changed

• BREAKING (inherited from @quartz-community/utils): wikilink targets are now lowercased when slugified (e.g. [[My Note]] resolves to my-note instead of My-Note). This matches Obsidian's case-insensitive link-matching behavior.

Removed

• BREAKING: disableBrokenWikilinks option. The broken-link check has been moved to @quartz-community/crawl-links, which owns link resolution and can honor its own markdownLinkResolution strategy without the two plugins drifting. Users who had disableBrokenWikilinks: true under ObsidianFlavoredMarkdown must move it to CrawlLinks. The new location also covers broken markdown links (e.g. [text](https://github.com/quartz-community/obsidian-flavored-markdown/blob/main/nowhere)), not just wikilinks.

Commits

• dc9256d fix(ci): add NODE_AUTH_TOKEN for npm publish
• bc5b853 Merge pull request #5 from quartz-community/changeset-release/main
• 419edc0 chore: version package
• f9cf161 chore: add changeset for patch release
• 0b3ff34 fix: prevent callout body text from leaking into title with nested blockquote...
• 281ac67 fix: use changesets/action@v1 (v2 is prerelease)
• ca02eeb chore: add changesets release workflow
• 396ecaf chore: migrate to npm publishing
• See full diff in compare view

Attestation changes

This version has no provenance attestation, while the previous version (0.1.1) was attested. Review the package versions before updating.

Updates @quartz-community/og-image from 0.1.1 to 0.1.2

Release notes

Sourced from @​quartz-community/og-image's releases.

v0.1.2

Patch Changes

• ab7b8e9: Fix build crash when Google Fonts is unreachable (fetch failed). Added error handling to font fetching, system font fallback for macOS/Linux/Windows, and graceful skip when no fonts are available.

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog and this project adheres to Semantic Versioning.

Changelog

Sourced from @​quartz-community/og-image's changelog.

0.1.2

Patch Changes

• ab7b8e9: Fix build crash when Google Fonts is unreachable (fetch failed). Added error handling to font fetching, system font fallback for macOS/Linux/Windows, and graceful skip when no fonts are available.

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog and this project adheres to Semantic Versioning.

[Unreleased]

Added

• Initial Quartz community plugin template.

Commits

• e4363e3 chore: version package (#1)
• ab7b8e9 chore: add changeset for fetch fallback fix
• 34be668 fix: handle Google Fonts fetch failure with system font fallback
• 73dae18 fix(ci): add NODE_AUTH_TOKEN for npm publish
• 43ccb11 fix: use changesets/action@v1 (v2 is prerelease)
• edbaea4 chore: add changesets release workflow
• 250be21 chore: migrate to npm publishing
• 0350063 chore: update @​quartz-community/utils to 8d2e14b
• ee13d16 deps: update @​quartz-community/utils to latest
• d63abb3 fix: add createRequire banner for CJS compat in ESM bundles
• Additional commits viewable in compare view

Attestation changes

This version has no provenance attestation, while the previous version (0.1.1) was attested. Review the package versions before updating.

Updates isomorphic-git from 1.38.9 to 1.40.0

Release notes

Sourced from isomorphic-git's releases.

v1.40.0

1.40.0 (2026-07-23)

Features

• log: include changed file object ids (#2385) (5aff8af)

v1.39.0

1.39.0 (2026-07-23)

Features

• commit: add disallowEmpty option (#2384) (bb1c7c2)

v1.38.10

1.38.10 (2026-07-21)

Bug Fixes

• statusMatrix: do not traverse symlinks in GitWalkerFs (#1215) (#2382) (90ea101)

Commits

• 5aff8af feat(log): include changed file object ids (#2385)
• bb1c7c2 feat(commit): add disallowEmpty option (#2384)
• 90ea101 fix(statusMatrix): do not traverse symlinks in GitWalkerFs (#1215) (#2382)
• See full diff in compare view

Updates minimatch from 10.2.5 to 10.2.6

Commits

• ded1bbd 10.2.6
• 0215dfe update deps and lint
• 10968ea improve test for .. eating drive letters
• See full diff in compare view

Updates yargs from 18.0.0 to 18.1.0

Changelog

Sourced from yargs's changelog.

18.1.0 (2026-07-26)

Features

• ignore bun when getting bin name (b77831c)

Bug Fixes

• lang: 'count' for de locale (#2476) (971e351)
• local prototype pollution vulnerability in apply-extends (437f3a4)
• locale: add Georgian translation (#2474) (086aeaa)

17.7.3 (2026-06-19)

Bug Fixes

• fix: use entry point with file extension for anything that supports exports (#2514) (c7597e3)

16.2.2 (2026-06-19)

Bug Fixes

• fix: use entry point with .cjs file extension for yargs export (#2546) (6feb819)

Commits

• 8878a89 chore(main): release 18.1.0 (#2475)
• db916b4 chore: add workflow_dispatch for release-please (#2564)
• 4153e0f chore: improve build robustness (#2554)
• 186d2e6 docs: clarify nargs option-like values (#2551)
• c615633 docs: fix various typos in source code (#2525)
• 7c76d0a docs: fix broken links in api.md (#2549)
• 37e2e5b chore: fix .wrap() docs (#2493)
• 547e300 chore: update the easy dependencies (#2552)
• e086681 chore(deps): update dependency cross-env to v10 (#2480)
• 88f548c chore: fix typos (#2492)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by shadowspawn, a new releaser for yargs since your current version.

Updates @quartz-community/types from 0.2.1 to 0.3.0

Release notes

Sourced from @​quartz-community/types's releases.

v0.3.0

Minor Changes

• 201e021: Update PageFrameProps.footer from QuartzComponent to QuartzComponent[] to support configurable footer positioning in the unified layout slot architecture.

Changelog

Sourced from @​quartz-community/types's changelog.

0.3.0

Minor Changes

• 201e021: Update PageFrameProps.footer from QuartzComponent to QuartzComponent[] to support configurable footer positioning in the unified layout slot architecture.

Commits

• 0f5711d Merge pull request #1 from quartz-community/changeset-release/main
• 6595c88 chore: version package
• 201e021 chore: add changeset for PageFrameProps footer type change
• 9bdab4c feat: update PageFrameProps footer to QuartzComponent array
• 85e4b32 fix(ci): add NODE_AUTH_TOKEN for npm publish
• dff3295 fix: use changesets/action@v1 (v2 is prerelease)
• 3cd6009 chore: add changesets release workflow
• 22f88fa chore: migrate to npm publishing
• See full diff in compare view

Attestation changes

This version has no provenance attestation, while the previous version (0.2.1) was attested. Review the package versions before updating.

Updates @quartz-community/utils from 0.1.0 to 0.1.1

Release notes

Sourced from @​quartz-community/utils's releases.

v0.1.1

Patch Changes

• 1eb2dd8: Fix getFullSlugFromUrl() to decode URI-encoded pathnames. Non-ASCII characters (Cyrillic, Chinese, etc.) in page titles were URL-encoded in the browser pathname but not decoded before slug comparison, causing mismatches in graph, search, and other client-side features.

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog and this project adheres to Semantic Versioning.

Changelog

Sourced from @​quartz-community/utils's changelog.

0.1.1

Patch Changes

• 1eb2dd8: Fix getFullSlugFromUrl() to decode URI-encoded pathnames. Non-ASCII characters (Cyrillic, Chinese, etc.) in page titles were URL-encoded in the browser pathname but not decoded before slug comparison, causing mismatches in graph, search, and other client-side features.

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog and this project adheres to Semantic Versioning.

[Unreleased]

Added

• Initial Quartz community plugin template.

Changed

• BREAKING: slugifyPath, slugifyFilePath, and slugTag now lowercase their output to match Obsidian's case-insensitive link- and tag-matching semantics. Previously all three preserved case. This means [[My Note]] and [[my note]] both resolve to the slug my-note, and the tags #MyTag and #mytag collapse into a single tag page. Downstream effects: all generated URLs are now lowercase; users upgrading from earlier Quartz v5 betas with mixed-case source filenames will see their URLs change (e.g. /MyNote → /my-note). Also eliminates silent data loss on case-insensitive filesystems (macOS APFS, Windows NTFS), where Apple.md and apple.md previously produced conflicting HTML outputs that overwrote each other without warning.

Commits

• 9da5e8d fix(ci): add NODE_AUTH_TOKEN for npm publish
• 5669e44 Merge pull request #2 from quartz-community/changeset-release/main
• b039fb5 chore: version package
• 1eb2dd8 chore: add changeset for patch release
• d16d8d9 fix: decode URI in getFullSlugFromUrl for non-ASCII slugs (#2491)
• 1f3cdc5 fix: use changesets/action@v1 (v2 is prerelease)
• 98ff777 chore: add changesets release workflow
• f6bbd3a chore: migrate to npm publishing
• See full diff in compare view

Attestation changes

This version has no provenance attestation, while the previous version (0.1.0) was attested. Review the package versions before updating.

Updates @types/node from 26.1.1 to 26.1.2

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.