Bump d3-color and d3-node in /apps/functional_chat

[dependabot]

Bumps d3-color to 3.1.0 and updates ancestor dependency d3-node. These dependencies need to be updated together.

Updates d3-color from 1.4.1 to 3.1.0

Release notes

Sourced from d3-color's releases.

v3.1.0

• Add rgb.clamp and hsl.clamp. #102
• Add color.formatHex8. #103
• Fix color.formatHsl to clamp values to the expected range. #83
• Fix catastrophic backtracking when parsing colors. #89 #97 #99 #100 SNYK-JS-D3COLOR-1076592

v3.0.1

• Make build reproducible.

v3.0.0

• Adopt type: module.

This package now requires Node.js 12 or higher. For more, please read Sindre Sorhus’s FAQ.

v2.0.0

This release adopts ES2015 language features such as for-of and drops support for older browsers, including IE. If you need to support pre-ES2015 environments, you should stick with d3-color 1.x or use a transpiler.

Commits

• 7a1573e 3.1.0
• 75c19c4 update LICENSE
• ef94e01 update dependencies
• 5e9f757 method shorthand
• e4bc34e formatHex8 (#103)
• ac660c6 {rgb,hsl}.clamp() (#102)
• 70e3a04 clamp HSL format (#101)
• 994d8fd avoid backtracking (#100)
• 7d61bbe 3.0.1
• 93bc4ff related d3/d33; extract copyrights from LICENSE
• Additional commits viewable in compare view

Updates d3-node from 3.0.0 to 4.0.2

Commits

• 5d6c84c 4.0.2
• 37c0c53 bugfix and cleanup
• 6a1ef23 v4.0.1 - npm audit (#76)
• d993441 v4.0 - ES6 modernization (#75)
• ee66f13 add workflow node.js.yml (#72)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

---

Note

Medium Risk
Major d3-node bump changes how server-side charts are rendered (D3 v7 + jsdom vs bundled D3 v5); regression risk is in any code paths that rely on d3-node, though no direct imports showed up in app source.

Overview
Dependency bump in functional_chat: d3-node is upgraded from 3.0.0 to 4.0.2 in package.json, with the lockfile regenerated.

The major d3-node release stops vendoring D3 v5 and instead declares d3 ^7.9.0 (aligned with the app’s existing d3 dependency), which removes a large nested d3-node/node_modules/d3 subtree and related legacy packages (e.g. d3-collection, d3-voronoi). The lockfile also drops optional native/tooling chains that were tied to the old tree (e.g. canvas, ts-node peers).

Some lockfile entries switch from latest to * for dev tooling (eslint-config-next, next-auth, @types/react, typescript); that is resolution metadata only—package.json still uses latest where it did before.

^{Reviewed by Cursor Bugbot for commit 0fa814b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
functional-chat	Ready	Preview	Jul 31, 2026 3:50pm
transcription-demo	Ready	Preview	Jul 31, 2026 3:50pm

[cursor]

Risk: medium. Left a non-blocking comment (not approved): this Dependabot PR major-bumps production d3-node 3→4 with large lockfile churn, so a human should confirm functional_chat still builds/renders as expected. Reviewers were assigned.

  

_{Sent by Cursor Approval Agent: Pull Request Approver}