chore(deps): bump billboard.js from 3.18.0 to 4.1.0

[dependabot]

Bumps billboard.js from 3.18.0 to 4.1.0.

Release notes

Sourced from billboard.js's releases.

4.1.0

4.1.0 (2026-09-16)

The detailed new feature description can be found at:

billboard.js 4.1.0: Live resizing, configurable subchart, React subpath & CSP-safe worker (dev.to link)

Bug Fixes

• bar: prevent invalid SVG arc flags on load() with bar.radius (f195b91), closes #4166
• boost: harden worker fallback paths (b4fe41a)
• grid: guard optional grid focus handlers (ce448fb), closes #4205
• plugin-tableview: validate constructor options and warn on invalid input (b98bb3f), closes #4140 by @​Loksly
• selection: honor multiple=false and point.focus.only in select API (0b7255c)
• util: Correctly detect empty objects with polluted prototype (78d47ff), closes #4193 by @​piotrp

Features

• boost: pre-bundle the worker source and add workerUrl (79aa7ec)
• canvas: support grid line class selectors (61cb9b7), closes #4164
• react: add react subpath export (e801ccf)
• resize: add resize.live to follow the container while resizing (e0309c8), closes #4219
• subchart: add focus grid toggle (2762d02), closes #4176
• subchart: support configurable subchart rendering (37ec4b7), closes #4175

4.1.0-next.3

4.1.0-next.3 (2026-09-14)

Features

• resize: add resize.live to follow the container while resizing (e0309c8), closes #4219

4.1.0-next.2

4.1.0-next.2 (2026-09-02)

Bug Fixes

• grid: guard optional grid focus handlers (ce448fb), closes #4205
• util: Correctly detect empty objects with polluted prototype (78d47ff), closes #4193

4.1.0-next.1

4.1.0-next.1 (2026-08-10)

Bug Fixes

• bar: prevent invalid SVG arc flags on load() with bar.radius (f195b91), closes #4166

... (truncated)

Changelog

Sourced from billboard.js's changelog.

4.1.0 (2026-09-16)

Bug Fixes

• bar: prevent invalid SVG arc flags on load() with bar.radius (f195b91), closes #4166
• boost: harden worker fallback paths (b4fe41a)
• grid: guard optional grid focus handlers (ce448fb), closes #4205
• plugin-tableview: validate constructor options and warn on invalid input (b98bb3f), closes #4140
• selection: honor multiple=false and point.focus.only in select API (0b7255c)
• util: Correctly detect empty objects with polluted prototype (78d47ff), closes #4193

Features

• boost: pre-bundle the worker source and add workerUrl (79aa7ec)
• canvas: support grid line class selectors (61cb9b7), closes #4164
• react: add react subpath export (e801ccf)
• resize: add resize.live to follow the container while resizing (e0309c8), closes #4219
• subchart: add focus grid toggle (2762d02), closes #4176
• subchart: support configurable subchart rendering (37ec4b7), closes #4175

4.0.3 (2026-07-06)

Bug Fixes

• security: escape attribute context in text background filter (ff22a37)

4.0.2 (2026-07-06)

Bug Fixes

• canvas: skip line points in subchart (3831ec6)
• legend: prevent hidden legend hover from dimming visible legends on canvas (3ae8438), closes #4158 #4159
• tooltip: fix focus point and tooltip for single x-axis (d7cba7f), closes #3968 #4156

4.0.1 (2026-06-16)

Bug Fixes

• types: add canvas subpath mapping (a6b180a)

4.0.0 (2026-06-16)

Bug Fixes

... (truncated)

Commits

• 51ca584 chore(release): 4.1.0 [skip ci]
• c4577b9 chore(deps): update dev dependencies and fix the resulting breakages (#4221)
• e0309c8 feat(resize): add resize.live to follow the container while resizing
• f4249fe refactor(data): reduce repeated aggregation and legend updates (#4217)
• ce448fb fix(grid): guard optional grid focus handlers
• 78d47ff fix(util): Correctly detect empty objects with polluted prototype
• 0d8423d skip: fix test fails
• 79aa7ec feat(boost): pre-bundle the worker source and add workerUrl
• b4fe41a fix(boost): harden worker fallback paths
• e801ccf feat(react): add react subpath export
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Summary

Update the production Billboard capability and PPTX development dependency to Billboard 4.1.0. Real packed consumers were tested with 4.1.0 and caret-selected4.1.1, including the actual PPTX Worker and chart SVG output.

Related issue

N/A: dependency maintenance reviewed at exact SHA b50ba5d6e9ed8530697629b79b32c958110a7676; no unrelated issue is closed.

Change classification

• User-visible UI or rendering change
• Non-visual change
• File-format or renderer behavior
• Public API, package, Worker, WASM, or deployment-path change

Verification

Actual local review on Node 24.20.0 and pnpm 11.0.9, at the unchanged SHA above:

Check	Result
pnpm build	Pass
pnpm type-check	Pass
pnpm test	Pass
pnpm exec vitest run --reporter=dot	Pass: 30 files, 258 tests; 1 existing skip remains a skip
pnpm audit --json --registry=https://registry.npmjs.org	Fail: 19 current shared-base advisory records, including 1 critical and 9 high; these are not introduced by this scoped update

The separately retained original PPTX cold cases passed for both physical Billboard versions in both browsers. Original native sample bytes and screenshots remain local.

Current shared security findings are handled in verified draft #337. This PR is not approved for landing on its unchanged vulnerable base. No merge or npm publication occurred.

Sample / fixture evidence

• Public repository fixture/source: https://github.com/flyfish-dev/file-viewer/blob/b50ba5d6e9ed8530697629b79b32c958110a7676/apps/viewer-demo/public/example/en/sample-presentation.pptx
• Complete local commands and focused native/cold evidence are retained for this exact SHA; original attachments and screenshots are not committed.

Visual evidence

N/A: this dependency-only update makes no intentional UI change; native rendering controls are described above with their precise scope.

Risk and compatibility

• Affected packages/formats: Production Billboard capability and PPTX chart integration; this update is not limited to development dependencies.
• Compatibility or migration risk: Four cold consumer cases passed: versions 4.1.0/4.1.1 in Chromium/WebKit, without React installed. Native 9-slide/9-chart data API, line/bar output and repeated cleanup passed. This is not a claim that every upstream chart type or PowerPoint pixel layout was tested. Current shared-base security audit still fails and must be resolved before landing.
• Rollback: revert this dependency update and its lockfile changes as one unit; preserve the independent security fixes.

Checklist

• Existing focused coverage and the actual checks above exercised this change; no duplicate source-only test was added for a metadata repair.
• Documentation scope is explained above; this change does not announce unverified API or rendering behavior.
• Actual Worker/cold consumer checks are identified above when relevant; development-only changes do not change deployment URLs or assets.
• No secrets, private samples, generated caches or unrelated source changes were committed during this review.