fix(deps): bump color-convert from ^2.0.1 to v3 (main)

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
color-convert	^2.0.1 → ^3.1.3

---

Release Notes

Qix-/color-convert (color-convert)

v3.1.3

Compare Source

What's Changed

• return muttable array from convert.keyword.rgb by @​pete-mcwilliams in #​125

New Contributors

• @​pete-mcwilliams made their first contribution in #​125

Full Changelog: Qix-/color-convert@3.1.2...3.1.3

v3.1.2

Compare Source

Functionally identical release to 3.1.0.

Version 3.1.1 is compromised. Please see debug-js/debug#1005.

v3.1.0

Compare Source

What's Changed

• Implement OKLAB color space conversions by @​Neraste in #​116

New Contributors

• @​Neraste made their first contribution in #​116

Full Changelog: Qix-/color-convert@3.0.1...3.1.0

v3.0.1

Compare Source

v3.0.0

Compare Source

What's Changed

• add common scales to README by @​oclyke in #​79
• fix: better precision on xyz/srgb conversion by @​Ignigena in #​77
• Use 4 largest bits for rgb->ansi256 gray check by @​spenserblack in #​75
• Switch to GitHub Actions CI by @​spenserblack in #​91
• Update readme by @​jimmywarting in #​107
• Move to ESM by @​LitoMore in #​102

New Contributors

• @​oclyke made their first contribution in #​79
• @​Ignigena made their first contribution in #​77
• @​spenserblack made their first contribution in #​75
• @​jimmywarting made their first contribution in #​107
• @​LitoMore made their first contribution in #​102

Full Changelog: Qix-/color-convert@2.0.1...3.0.0

---

Configuration

📅 Schedule: (in timezone Europe/Vienna)

• Branch creation
  • "before 5am on wednesday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[ChristophWurst]

@coderabbitai review and try to spot any relevant breaking changes in this major bump

[coderabbitai]

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "=== package.json color-convert refs ==="
grep -n "color-convert" package.json || true
echo "=== package-lock.json entries ==="
grep -n "\"color-convert\"" -A5 package-lock.json | head -100
echo "=== search for direct usage in src ==="
rg -n "color-convert" --type js --type ts -g '!package-lock.json' . || true
rg -n "require\(.color-convert" . || true
rg -n "from ['\"]color-convert" . || true
echo "=== find which deps depend on color-convert ==="
rg -n "color-convert" package-lock.json | head -50

Length of output: 2511

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail
echo "=== calendarColor.js ==="
cat -n src/util/calendarColor.js
echo "=== AccountColor.js ==="
cat -n src/util/AccountColor.js
echo "=== package.json module type ==="
grep -n '"type"' package.json
echo "=== color-convert package.json (v3) ==="
sed -n '1,40p' node_modules/color-convert/package.json 2>/dev/null || echo "not installed in sandbox"

Length of output: 4899

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail
echo "=== node_modules color-convert (v3) presence ==="
fd -HI package.json node_modules/color-convert 2>/dev/null
echo "=== try locate any color-convert files ==="
fd . node_modules/color-convert 2>/dev/null | head -50
echo "=== check package.json 'exports'/'type' field if present ==="
cat node_modules/color-convert/package.json 2>/dev/null || echo "no file"
echo "=== webpack/babel config check ==="
fd -HI webpack.config -e js -e cjs . 2>/dev/null
grep -n '"browserslist"\|"babel"' -A5 package.json | head -30

Length of output: 901

---

🤖 web_search executed:

color-convert npm v3.0.0 breaking changes ESM default export CommonJS require

Length of output: 6427

---

🤖 web_search executed:

color-convert v3.0.0 package.json engines node version requirement

Length of output: 3527

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail
echo "=== webpack config files ==="
fd -HI -e js -e cjs -e mjs '^webpack' . 2>/dev/null
echo "=== package.json webpack version ==="
grep -n '"webpack"' package.json
echo "=== check `@nextcloud/webpack-vue-config` or similar ==="
grep -n "webpack" package.json | head -20
echo "=== node engines field ==="
grep -n '"engines"' -A5 package.json

Length of output: 1234

---

I've reviewed the color-convert v2 → v3 bump used in src/util/calendarColor.js and src/util/AccountColor.js.

Findings:

1. ESM-only rewrite (v3.0.0, #102 "Move to ESM") — This is the headline breaking change. color-convert dropped its CommonJS build and now ships pure ESM (export default convert). Since this repo builds with Webpack 5 (webpack.common.js / webpack.dev.js / webpack.prod.js, webpack: ^5.106.2) and both call sites already use import convert from 'color-convert' / import conv from 'color-convert', Webpack 5 handles ESM dependencies natively, so this bundles fine. No native Node require('color-convert') calls were found anywhere in src/, so there's no runtime CJS-interop risk.

2. API surface unchanged — rgb.hex, hex.hsl, and hsl.hex (the only functions used, in Line 17 of calendarColor.js and Lines 11/14 of AccountColor.js) keep the same names, argument shapes, and return types across v2 → v3. No code changes are required for these call sites.

3. v3.1.3 "keyword.rgb now returns a mutable array" — a minor bugfix, not used here (keyword conversions aren't referenced in this codebase), so irrelevant.

4. Node engine bump — color-convert now requires Node.js ≥14.6, well below this repo's engines.node: ^24.0.0, so no compatibility concern there.

5. Supply-chain note — v3.1.1 was flagged as compromised (see debug-js/debug#1005), but package-lock.json resolves the main dependency to the safe 3.1.3, so this PR is not affected. (Note: a nested transitive dependency, @ckeditor/ckeditor5-ui → color-convert@3.1.0, is unrelated to this bump and also predates the compromised 3.1.1.)

Overall, this looks like a safe, low-risk major bump — the only structural change (ESM-only) is already compatible with the existing Webpack-based build and import style used in this repo.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

📝 Walkthrough

Walkthrough

The dependency version constraint for color-convert in package.json is updated from ^2.0.1 to ^3.1.3.

Changes

Dependency version update

Layer / File(s)	Summary
Update color-convert dependency constraint package.json	The color-convert version range is changed from ^2.0.1 to ^3.1.3.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers: ChristophWurst, kesselb, GretaD

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the dependency bump for color-convert to v3, matching the PR's main change.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch renovate/main-color-convert-3.x

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}