2.0.4

Dependency updates and the last round of plugin-review follow-ups. No user-facing changes intended.

Dependencies

• Every dependency advisory is cleared (bun audit: 91 → 0). Dependencies moved within their declared ranges (LangChain 1.5.x / core 1.2.x patches, deepagents 1.13, Pixi 8.20, Svelte 5.57, Vite 7.3.6, Vitest 4.1), and the transitive packages whose ranges still admitted vulnerable versions are pinned through overrides — all dev tooling or server-side halves of the MCP SDK that never reach the bundle. (#469)
• The build guard added in 2.0.3 did its job on the way: Pixi renamed one of its eval-based generators and the Anthropic SDK now ships its own browser stub for its local toolset, and the build refused to ship until both were accounted for. The bundle still contains no process spawning or dynamic code execution. (#469)

Plugin review

• The stylesheet no longer uses the @tailwind at-rules (same output, plain CSS to any linter), an unused import is gone, and several !important overrides that only had to beat core's specificity are replaced with specific selectors. One of them uncovered a bug from 2.0.3: the search modal's glow border was targeting a class its element never carries; it works now. (#470)

Still flagged, by design

Vault enumeration (indexing needs it) and clipboard access (the copy-message button). The remaining !important declarations override theme rules that are themselves !important, or raise mobile touch-target sizes.