build(deps): bump the swift-dependencies group with 2 updates

[dependabot]

Bumps the swift-dependencies group with 2 updates: github.com/sparkle-project/sparkle and github.com/nodes-app/swift-markdown-engine.

Updates github.com/sparkle-project/sparkle from 2.9.4 to 2.9.6

Release notes

Sourced from github.com/sparkle-project/sparkle's releases.

2.9.6 Appcast Improvements

Changes:

• Harden safety of installer moving the download archive (#2898) (Zorg, Joshua Rogers)
• Don't copy progress tool for root user (#2897) (Zorg, Joshua Rogers)
• Reject package based installs when signing validation failed (#2895) (Zorg)

This release contains a couple of security fixes reported by @​MegaManSec including a high-complex symlink security fix, and a privilege escalation fix affecting processes running as root using Sparkle (like running sparkle-cli as root). Details are updated in sparkle-project/Sparkle#2838.

Please also check 2.9.5, 2.9.4, 2.9.3, 2.9.2, 2.9.1, and 2.9.0 for previous changes.

2.9.5 Appcast Improvements

Changes:

• Harden patching delta file against symbolic link at destination path (#2891) (Zorg, Arpit Jain)

This release contains a high-complex symlink security fix reported by @​ararpitjain099 (this is a more complete fix to an issue identified in 2.9.2). Details are updated in sparkle-project/Sparkle#2838.

Please also check 2.9.4, 2.9.3, 2.9.2, 2.9.1, and 2.9.0 for previous changes.

Commits

• ac2def2 Update Package management files for version 2.9.6
• de8eb17 Update CHANGELOG for 2.9.6
• f6bc73a Harden safety of installer moving the download archive
• 51245ef Reject package based installs when signing validation failed (#2895)
• c34faae Don't copy progress tool for root user (#2897)
• 79bc9e8 Update Package management files for version 2.9.5
• be4882f Update CHANGELOG for 2.9.5
• 77669ea Harden patching delta file against symbolic link at destination path (#2891)
• See full diff in compare view

Updates github.com/nodes-app/swift-markdown-engine from 0.11.0 to 0.12.0

Release notes

Sourced from github.com/nodes-app/swift-markdown-engine's releases.

0.12.0 — Scroll memory across an unmount, linear inline parsing, copied links

Scroll memory an embedder can keep

New onPersistScrollOffset / restoreScrollOffset on NativeTextViewWrapper, plus a real dismantleNSView. An embedder that routed away from the editor and back — to a home screen, a tag page — reopened every note at the top. Note-to-note was always fine.

Three things had to give, each sufficient on its own: the engine's per-document offsets live on the coordinator, which dies with the view; nothing recorded the offset on the way out, because there was no dismantleNSView in the package at all; and the restore was gated on a document switch, which a remount is not (makeCoordinator seeds documentId, so the first update pass never looks like one).

Teardown hands the offset over now, and the restore is latched rather than gated — the first pass after a remount still carries the embedder's empty buffer, so it has to try again on the pass that brings the real content. The latch gives up once the text is non-empty: a missed restore is one wrong offset, an armed latch teleports the reader minutes later. Both closures are asked at call time rather than snapshotted, so an embedder's own retention rules can see changes made on the way out. Passing neither leaves behavior unchanged.

Inline parsing is linear in the spans per region

Every pass after the first consulted the claimed ranges by scanning the whole array — once per character in scanEscapes and collectDelimiterRuns, once per candidate in scanLinkFamily — and buildTree decided containment by testing each span against every other. The passes walk the string left to right and claimed ranges never partially overlap, so a cursor over the sorted ranges answers both questions in amortised constant time.

A paragraph of 240 code spans parses in 0.5 ms rather than 33 ms; 6× the spans now costs 6× the parse instead of ~30×. Affects every claimed-span construct — code, escapes, links, images, wiki links, inline LaTeX, emphasis, extension spans. No parse result changes.

Copied URLs and emails arrive as real links

The editor styler linkifies bare URLs with NSDataDetector, but the HTML renderer emitted them as plain text — so the pasteboard's HTML, RTF and web-archive flavors carried no anchor at all, and whether a copied URL arrived clickable was left to the receiving app. MarkdownHTMLRenderer now wraps detector matches in <a href> (emails as mailto:) using the same system detector as the styler, and the RTF and web-archive flavors are derived from that HTML, so all three inherit the link.

Explicit [title](https://github.com/nodes-app/swift-markdown-engine/blob/HEAD/url) links were always correct. A URL-shaped run inside a link's own title stays plain so anchors never nest, and code spans remain excluded, matching the styler.

Changed

• ==highlight== fills the line box. AppKit paints .backgroundColor over ascent + descent only, so the marker fell short of the line height and a highlight that wrapped came out as a stack of bands. The new NSAttributedString.Key.markdownBlockBackground is painted across the whole line box by MarkdownTextLayoutFragment and is available to embedder extensions wherever a fill should read as a block.

Fixed

• Markdown link labels may hold inline code and escaped punctuation — [`App`](https://github.com/nodes-app/swift-markdown-engine/blob/HEAD/tmp/App.swift:56) stayed literal, because the link pass rejected every candidate overlapping an already claimed span, including one lying entirely inside the label.
• Initially narrow tables reflow when the editor width shrinks, instead of retaining stale image geometry until an unrelated full restyle.

Known limitations

• Table cells render no inline markup on the copy path: bold, explicit links and autolinked URLs inside a cell reach the pasteboard as raw markdown text.

Full changelog: nodes-app/swift-markdown-engine@0.11.0...0.12.0

Contributors

by @​wildthink — inline parse cost linear in the spans per region (#140). by @​YishenTu — narrow tables reflow after a width change (#117). by @​yukihiratype2 — inline code spans and escaped punctuation in link labels (#118). by @​xandaaaa — autolinked URLs and emails in the HTML renderer (#144). by @​luca-chen198 — scroll memory across an unmount (#143) and the line-box highlight.

Commits

• e5f7607 chore(release): 0.12.0
• 2a91937 Autolink bare URLs and emails in the HTML renderer (#144)
• 129429b Let an embedder keep the scroll offset when the editor is unmounted (#143)
• 0f201ac Restyle narrow tables after width changes (#117)
• 350b2d3 Take the span-density cost assertions off CI
• 5daf294 Inline parse cost linear in spans per region, not quadratic (#140)
• 1a2bd74 Allow inline code in Markdown link labels (#118)
• eaed9dd Make a pull request the default way in
• 5556ebc docs: credit Nodes in its own section, and say what support means (#116)
• 2d1318b Highlight fills the line box, so a wrapped mark is one block
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[opencode-agent]

User dependabot[bot] does not have write permissions

github run

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	dayline-website	fd23c71	Sep 01 2026, 05:02 PM