release: 0.273.3 - dependency updates

.github/dependabot.yml

@@ -15,6 +15,16 @@ updates:
       web-deps:
         patterns: ["*"]
         update-types: ["minor", "patch"]
+    ignore:
+      # @types/node tracks the Node runtime, which CI pins (node-version '22' in ci.yml). A major bump
+      # (e.g. 26) types APIs that runtime does not have, so it only moves alongside the CI Node version.
+      - dependency-name: "@types/node"
+        update-types: ["version-update:semver-major"]
+      # jsdom 30.1 renamed its Blob internals (`_buffer` -> `_bytes`), and vitest 4's createObjectURL
+      # shim still reads `_buffer`, so every test making an object URL from a Blob throws. Vitest 5
+      # reads both. Held at 30.0.x until the vitest 5 upgrade - issue #791 - then drop this.
+      - dependency-name: "jsdom"
+        versions: [">=30.1.0"]
 
   # Electron desktop shell.
   - package-ecosystem: "npm"

apps/desktop/package.json

@@ -1,7 +1,7 @@
 {
   "name": "diariz-desktop",
   "private": true,
-  "version": "0.273.2",
+  "version": "0.273.3",
   "description": "Diariz desktop app — a tray / menu-bar shell that loads your Diariz server, with mic + system-audio capture (Windows; macOS beta).",
   "main": "src/main.js",
   "author": "Ken Hayward",

apps/web/package.json

@@ -1,7 +1,7 @@
 {
   "name": "diariz-web",
   "private": true,
-  "version": "0.273.2",
+  "version": "0.273.3",
   "type": "module",
   "scripts": {
     "dev": "vite",

apps/web/src/lib/releaseNotes/current.ts

@@ -8,6 +8,22 @@ import type { Release } from "./types";
 /// these entries to the top of `archive.ts`. releases.test.ts fails above 80 entries, which is a
 /// safety net rather than the trigger; the historical epochs average 16.
 export const RECENT: Release[] = [
+  {
+    version: "0.273.3",
+    date: "2026-10-01",
+    pr: 793,
+    headline: "Dependency updates",
+    summary:
+      "A routine round of library updates across the web app, desktop app, server and transcription worker. Nothing changes in how Diariz works.\n\nThe server picks up a security fix in OpenIddict, the library behind sign-in for connected apps such as the Claude connector, which tightens how it checks who a client request is meant for. The web app gets the current React, editor and sanitiser releases, and the desktop app moves to the latest Electron 44 patch, which arrives with the next desktop release.\n\nThe transcription worker was checked on a GPU with the newest speaker-separation release, and its storage library was checked against the SeaweedFS store that now holds recordings.",
+    changed: [
+      "Server libraries updated, including the S3 client, OpenIddict, Redis, Sentry, MailKit and SkiaSharp",
+      "Web libraries updated, including React 19.3, the Tiptap editor, DOMPurify, markdown-it, i18next and React Router",
+      "Desktop shell updated to Electron 44.4.5, plus js-yaml, fast-uri, brace-expansion and undici",
+      "Transcription worker requires pyannote.audio 4.0.7 or newer, and updates boto3 and the Sentry SDK",
+      "CodeQL scanning action updated",
+      "Dependabot no longer proposes major @types/node updates, which follow the Node version CI runs, and holds jsdom below 30.1 until the vitest 5 upgrade (#791)",
+    ],
+  },
   {
     version: "0.273.2",
     date: "2026-10-01",

integrations/n8n-nodes-diariz/package.json

@@ -1,6 +1,6 @@
 {
   "name": "n8n-nodes-diariz",
-  "version": "0.273.2",
+  "version": "0.273.3",
   "description": "n8n community node for Diariz meeting transcription: react to transcriptions and drive the full REST API.",
   "keywords": [
     "n8n-community-node-package",

src/Diariz.Api/Diariz.Api.csproj

@@ -5,7 +5,7 @@
     <Nullable>enable</Nullable>
     <ImplicitUsings>enable</ImplicitUsings>
     <!-- App version — keep in sync with /version.json (see CLAUDE.md versioning rule). -->
-    <Version>0.273.2</Version>
+    <Version>0.273.3</Version>
   </PropertyGroup>
 
   <ItemGroup>

version.json

@@ -1,3 +1,3 @@
 {
-  "version": "0.273.2"
+  "version": "0.273.3"
 }