The @progress/kendo-ui npm package creates the following dependency tree:

@progress/kendo-ui 2026.1.415
 |
  - @progress/kendo-pdfviewer-common ^0.6.4 -> 0.6.4
    |
     - pdfjs-dist 4.6.82 -> 4.6.82
       |
        - canvas ^2.11.2 -> 2.11.2
          |
           - @mapbox/node-pre-gyp ^1.0.0 -> 1.0.11
             |
              - tar ^6.1.11 -> 6.2.1

All packages have been updated to the latest version possible.

Versions <= 7.5.10 of tar have multiple known vulnerabilities:

• node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal - https://github.com/advisories/GHSA-34x7-hfp2-rc4v
• node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization - https://github.com/advisories/GHSA-8qq5-rm4j-mr97
• Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction - https://github.com/advisories/GHSA-83g3-92jg-28cx
• tar has Hardlink Path Traversal via Drive-Relative Linkpath - https://github.com/advisories/GHSA-qffp-2rhf-9h96
• node-tar Symlink Path Traversal via Drive-Relative Linkpath - https://github.com/advisories/GHSA-9ppj-qmqm-q256
• Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS - https://github.com/advisories/GHSA-r6q2-hw4h-h46w

I am using the Kendo-UI Grid's resizeColumn method do change column widths programmatically (e.g., to distribute column widths by our own custom rules). I have noticed that doing so sometimes leads to unexpected results as demonstrated in this DOJO:

Assume a grid with two columns: one has a fixed size of 200px and the other has no explicit width set.

In the first example, we programmatically set the first column's width to 200px (which should not change anything since the column already is 200px wide. 

grid.resizeColumn(column, 200);

This works as expected.

In the second example, we programmatically set the first column's width first to 20px and then immediately to 200px. I would expect the final outcome to be the same, since the second column should compensate.

grid.resizeColumn(column, 20);
grid.resizeColumn(column, 200);

However, the second column does not shrink and the overall grid grows larger instead. Doing this repeatedly causes the columns to grow larger and larger over time.

Of course, this is a simplified example and I do not call resizeColumn() twice right after each other.

In Kendu UI 2026 Q2 (version 520) file kendo.all.d.ts

The interface IChatOptions has a duplicate defintion for the messageTemplate

Line 3849:

messageTemplate?: MessageTemplateFunction | null;

Lines 3916/3917   

/** Template for rendering individual messages */
messageTemplate?: MessageTemplateFunction | null;

Bug report

Current behavior

Errors during build process:

(replace-metadata plugin) [SOURCEMAP_BROKEN] Sourcemap is likely to be incorrect: a plugin (replace-metadata) was used to transform files, but didn't generate a sourcemap for the transformation. Consult the plugin documentation for help: https://rolldown.rs/guide/troubleshooting#warning-sourcemap-is-likely-to-be-incorrect

Expected/desired behavior

There should be no errors

TicketID:

1716119