[dependabot]

Bumps usb from 2.18.0 to 3.2.1.

Changelog

Sourced from usb's changelog.

[3.2.1] - 2026-10-04

Changed

• Updated napi to v3.13.0 - 75 (Rob Moran)

Fixed

• Fixed concurrent access of endpoints - 59 (Rob Moran)

[3.1.0] - 2026-08-22

Fixed

• Guard against multiple hotplug watchers - 36 (Thomas Kirkman-Wood)

Changed

• Updated nusb to v0.2.7 - 43 (Rob Moran)
• Removed CoffeeScript - 29 (Rob Moran)

[3.0.1] - 2026-06-30

Fixed

• Fixed device control transfers on macOS/Linux - 16 (Rob Moran)
• Fixed device hotplug watching to be more efficient - 18 (Rob Moran)

Added

• Support for interrupt endpoints - 4 (León)

Changed

• Updated nusb to v0.2.4 - 14 (Rob Moran)
• Updated napi to v3.9.4 - 19 (Rob Moran)

[3.0.0] - 2026-06-06

Changed

• Initial release of the rust-based node-usb library
• Now uses the rust nusb library instead of libusb
• Dropped support for the Legacy API and exclusively uses the WebUSB API

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[marcmy]

Triage note: usb v3 is a major native USB transport change. This app uses WebUSB in src/lib/mouseBackends/razer.js and pulsarCrazyLight.js and getDeviceList in runtime.js and startupProbe.js; current CI uses mocks and does not prove physical dongle/HID behavior. This PR has green checks, but please validate cold-start detection, selection, polling-rate changes and reconnect for supported devices on actual Windows hardware before merging. Holding this major update rather than risking hardware regressions.

[marcmy]

Hardware regression reproduced by the user (Windows): testing this v3 dependency branch fails with an error resembling no command known "listDevices"; the app cannot reliably enumerate its mouse. This is a genuine blocker despite green mock CI. Root cause: usb v3 removes the v2 legacy API (getDeviceList() and legacy device objects); src/lib/mouseBackends/runtime.js and startupProbe.js use that synchronous API. v3 requires async usb.getDevices(), changes to discovery/callers/tests, and then full physical-device validation of both Razer and Pulsar transports. A simple package.json bump is not safe. Keep v2.18.x on main until a dedicated migration passes real dongle reconnect/polling tests. Reference: https://github.com/node-usb/node-usb-rs#apis .

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.