fix(deps): update dependency plotly.js-dist-min to v4

[renovate-bot-cbcoutinho]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
plotly.js-dist-min	^3.0.0 → ^4.0.0

---

Release Notes

plotly/plotly.js (plotly.js-dist-min)

v4.0.0

Compare Source

Added

• Add minscale, maxscale geo plot attributes [#​7371], with thanks to @​mojoaxel for the contribution!
• Enable TypeScript compatibility within the library and start exporting types [#​7680]
• Add quiver trace type to visualize vector fields using arrows [#​7710, #​7945], with thanks to @​degzhaus for the contribution!
• Use dashed markers in legend for shape traces with dash configured [#​7845]
• Add direction attribute to the Sankey trace, controlling the flow direction along the orientation axis [#​7870], with thanks to @​wf-r for the contribution!
  • forward keeps sources on the left (horizontal) or top (vertical)
  • reversed moves them to the right or bottom
• Add sort option to Sankey links and nodes [#​7873], with thanks to @​adamreeve for the contribution!
• Add support for MathJax v4 [#​7898]
• Add top-level xPixel and yPixel keys to hover and click event data, corresponding to the pixel position of the cursor relative to the top-left corner of the graph div [#​7966]
• When hoveranywhere is enabled, emit a plotly_unhover event when the cursor leaves the plot area [#​7966]

Removed

• Breaking: Remove scattermapbox, choroplethmapbox, densitymapbox trace types, the mapbox subplot, and the mapboxAccessToken config option [#​7860]
  • These traces have been deprecated since v3. Use the equivalent *map traces going forward.
• Breaking: Drop support for MathJax v2 [#​7898]
  • MathJax v3 and v4 are now supported in plotly.js
• Remove config attributes showLink, linkText, sendData, showSources, and showEditInChartStudio, as well as trace attribute stream, since all of these were associated with Chart Studio and are no longer needed [#​7812]
• Remove all *src attributes, as well as layout.hidesources attribute, from the schema [#​7829]
• Remove internal trace._fullInput property and other dead code related to the removed transforms feature. No user-facing changes expected [#​7834]

Changed

• Breaking: Switch color processing library from TinyColor to culori [#​7536], #​7962]
  • rgb()/rgba() strings with decimal 0–1 fractions are no longer interpreted as percentage values (relative to 255)
  • hsv() color strings are no longer permitted
  • New color formats are now supported: #ff0000aa, #f00a, rgb(255 0 0), rgba(255 0 0 / 0.5), hsl(0 100% 50% / 0.5), hsla(0, 100%, 50%, 0.5), lab(), lch(), oklab(), oklch(), color(), hsl(0.5turn 60% 40%), hsl(none 60% 40%)
  • rgb() now accepts an optional alpha, so rgb(255, 0, 0, 0.5) is no longer opaque (rgb and rgba are aliases per spec)
  • Color strings that are not valid CSS are now rejected, such as hsl(120, 50% 50%)
  • Contrasting text and border colors are picked by WCAG contrast ratio, so labels on saturated mid-tone fills may switch from dark to white
• Breaking: Set default layout.axis.tickmode to 'sync' when axis is overlaying [#​7684]
• Breaking: Change splom.axis.matches default from false to true [#​7843]
• Breaking: Replace country-regex with country-iso-search to search for country names in choropleth, scattergeo traces [#​7856]
  • The vast majority of country names are handled exactly the same with the new library; a small number of legacy entries have been removed
• Breaking: Update minimum required Node version to 22 [#​7861]
• Breaking: Change layout.geo.fitbounds default from false to 'locations' [#​7895]
  • geo subplots will now auto-fit the initial view to the trace data
  • Set fitbounds: false explicitly to opt out
• Breaking: Return actual data values (rather than calcdata values) for xvals / yvals in hoveranywhere and clickanywhere events. Date and category axes will now return strings rather than numeric values. Linear and log axis values remain unchanged. [#​7964]
• Enable scattermap icons to render in color, upgrade Maki icons version to 8.2, and standardize scattermap legend icons to circles [#​7825]
• Use plot title as default filename for "Download plot" button [#​7828]
• Change signature of plots.graphJson() function to remove mode argument [#​7829]
• Upgrade plotly/d3-sankey to 0.12.3. [#​7830], with thanks to @​adamreeve for the contribution!
• Update plot_config to show the "Upload to Cloud" button by default, and set the default server URL to cloud.plotly.com via [#​7909]
• Update "Share chart" dialog with more informative wording [#​7928]

Fixed

• Fix histogram autobin size for single-point traces in overlay mode on data updates via Plotly.react [#​7507], with thanks to @​Lexachoc for the contribution!
• Format tick labels correctly for small numbers in exponential notation [#​7768], with thanks to @​Hasnaathussain for the contribution!
• Defer automargin during scroll-wheel zoom, to prevent erratic jittering while zooming [#​7815], with thanks to @​keilogic for the contribution!
• Fix crash when ordering categories by value (e.g. sum descending) with null coordinates [#​7855]
• Prevent outside bar text for zero-length bars from overlapping axis tick labels [#​7872], with thanks to @​vizansh for the contribution!
• Fix scattermap, densitymap traces not showing all points by dynamically computing center, zoom values [#​7884, #​7913], with thanks to @​palmerusaf and @​DhruvGarg111 for the contributions!
• Fix GeoJSON bounding-box computation for choropleth and scattergeo traces whose geometry crosses the antimeridian [#​7891]
• Fix hovertemplate/texttemplate/tickformat/hoverformat improperly handling d3-format specs that start with a sign flag such as +.2f [#​7900], with thanks to @​TemRevil for the contribution!
• Snap cartesian axis tick values to multiple of delta so custom tickformat (e.g. "~r") no longer shows floating-point artifacts [#​7901], with thanks to @​arieleli01212 and @​kirthi-b for the contribution!
• Fix scattermap box and lasso selection across the antimeridian [#​7905], with thanks to @​coyaSONG for the contribution!
• Fix crash ("Something went wrong with axis scaling") when a colorbar's title or padding leaves it with a negative domain length [#​7908], with thanks to @​zeehio for the contribution!
• Prevent MultiPolygon features with no positive-area polygon from aborting choropleth rendering [#​7921], with thanks to @​swjturay for the contribution!
• Fix geo.fitbounds: 'locations' when mixing antimeridian-crossing territories with normal ones [#​7948]
• Fix issue where plot fails to render if unsupported MathJax version is present on page [#​7951]
• Fix numeric color sorting for bundled parallel-categories (parcats) paths [#​7959], with thanks to @​CAOShurong for the contribution!

---

Configuration

📅 Schedule: (in timezone Europe/Amsterdam)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
astrolabe-docs	Ready	Preview	Aug 28, 2026 4:05am

[claude]

Claude finished @renovate-bot-cbcoutinho[bot]'s task in 1m 23s —— View job

---

Claude's Review

• Gather context (PR diff, CLAUDE.md, repo conventions)
• Understand the request (review this Renovate major-version bump PR)
• Check plotly.js-dist-min usage in the codebase against the v4 breaking-change list
• Check for lockfile-only vs. code-impacting changes
• Post review feedback

---

Summary

This is a Renovate-generated major-version bump of plotly.js-dist-min (^3.0.0 → ^4.0.0), touching only package.json and package-lock.json. I checked the app's actual Plotly usage in src/App.vue:509-1789 (the 3D vector-space visualization) against the v4 breaking-change list.

Findings

No breaking-change collisions found for the features this app actually uses:

• Trace type is scatter3d — the removed scattermapbox/choroplethmapbox/densitymapbox/mapbox subplot doesn't apply (src/App.vue:1328, 1380).
• All colors used (#0082c9, #ef5350, #c62828, 'white') are valid hex/named CSS colors, so the TinyColor→culori swap and stricter CSS color parsing shouldn't affect rendering (src/App.vue:1347-1352, 1390-1394).
• Click handling uses the plotly_click event with curveNumber/pointNumber (src/App.vue:1436-1437, 1765-1767), not the new hoveranywhere/clickanywhere events, so the xvals/yvals calcdata→actual-value change doesn't apply.
• No splom, geo, config's removed Chart-Studio attributes (showLink, sendData, etc.), or MathJax usage found.
• package.json:6 already requires node: ^24.0.0, which satisfies v4's new Node ≥22 minimum, and CI (ci.yml, e2e.yml, release.yml) already runs Node 24.

Worth a quick manual check before merging — v4's changelog states it now "show[s] the 'Upload to Cloud' button by default, and set[s] the default server URL to cloud.plotly.com" (plotly/plotly.js#7909). The plot config here sets displayModeBar: true with no explicit modeBarButtonsToRemove/cloud-upload opt-out (src/App.vue:1424-1427). Since this panel renders potentially sensitive document titles/scores inside a self-hosted Nextcloud instance, it's worth verifying in a browser after this bump that no "send to cloud" control appears in the mode bar — if it does, it should be explicitly disabled in config (e.g. via modeBarButtonsToRemove) rather than left to the library default. This is a UI/privacy check, not a blocker for the dependency bump itself.

Test coverage: adequate for this change. tests/e2e/search.spec.ts:65-138 already exercises the Plotly 3D visualization end-to-end (renders the plot, asserts .main-svg visibility), which is the right net for a rendering-library bump like this — no new tests are needed per this repo's API-surface test-coverage gate, since this PR doesn't touch /apps/astrolabe/api/v1/* or the MCP client.

No security or performance concerns beyond the cloud-upload-button check above — this is a client-side visualization library with no server-side surface.

Recommendation

Safe to merge after confirming the e2e/CI build passes and, ideally, a quick manual look at the mode bar for any new cloud-upload affordance. Fix/verify this →

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud