This October 22 maintenance note covers the LibreLayer web deployment completed October 18, 2026 at 10:52 PM Saskatchewan time. The article was queued behind three October 21 updates; the software itself was already live. It is dependency maintenance within the existing 0.6 beta, not a new professional-editor certification.
Less unused code in the dependency graph
The update removes the unused shadcn scaffolding command-line package while retaining the required MIT-licensed stylesheet locally. The separate React UI package remains. Browser inference explicitly uses the Transformers.js web build, avoiding an unused Node inference backend and its supporting dependencies.
Patched versions of several supporting libraries are pinned in the lockfile. This is a targeted dependency change, not a replacement of the editor or a force-upgrade of its framework.
Replacing an affected build dependency
The dynamic-import build plugin now uses tinyglobby instead of the dependency chain that pulled in braces. The obsolete braces, micromatch, and fast-glob packages and the previous audit exception were removed from the locked dependency graph.
Regression coverage exercises both plugin entry points, file-extension alternatives, directory-index imports, recursive matches, paths containing spaces, hidden-file exclusions, and limits on pattern length and nesting. These checks protect expected build behavior; they do not make arbitrary untrusted code safe.
What the verification establishes
The recorded production-only and full dependency audits reported zero vulnerabilities at the time of the October 18 review. Audit results are a time-specific dependency check, not a guarantee of overall application security.
The reviewed local commit matches the source of the successful hosted deployment. No new desktop installer or store approval is implied. LibreLayer remains a browser-based beta; existing limitations around professional workflows and independent Photoshop compatibility validation still apply.