The dependencies will be updated with the next release as always.
https://github.com/jsreport/jsreport?tab=readme-ov-file#vulnerabilities

The release is scheduled for this week.

Yes, you can use a custom jsreport script where you can code what you need
https://jsreport.net/learn/scripts
https://jsreport.net/learn/pdf-utils#usage-in-script

const jsreport = require('jsreport-proxy')
async function afterRender (req, res) {
    res.content = await jsreport.pdfUtils.merge(res.content, Buffer.from(req.data.externalPdf, 'base64'))
}

Full demo here
https://playground.jsreport.net/w/anon/2lCyXIBl

It works the way jsreport takes your html as is and puts it into the docx file source.
When you open the Word app, it interprets the HTML.
jsreport does not influence how it is interpreted.

Perhaps you can try the docx recipe and docxHtml helper, if you need to display just a simple html.
This would let you modify the page size and orientation in the word template.
https://jsreport.net/learn/docx#docxhtml

Maybe you can implement your own helper "dynamicComponent" that receives the component code and returns the evaluated result.
It would be up to you where you download the component implementation.

https://playground.jsreport.net/w/anon/CQZ_3bC4

const jsreport = require('jsreport-proxy')

async function dynamicComponent(content, helpers) {
    return await jsreport.templatingEngines.evaluate({
      engine: 'handlebars',
      content: content,
      helpers: helpers,
      data: this
    }, {
      entity: jsreport.req.template,
      entitySet: 'templates'
    })
}

{{{dynamicComponent "some dynamic content {{myData}}" "function aHelper() {}"}}}

The custom users need to be persisted.

However, you can create a startup script that will import or create them.

See this config
https://jsreport.net/learn/configuration#workers
https://nodejs.org/api/worker_threads.html#worker_threads_worker_resourcelimits

Could you please let us know the default heap size?

These are the runtime/nodejs settings.
Each thread gets the same default limit as the main thread
~1.5 GB on 64-bit systems

How many percentage of RAM should be allocated to heap?

There is no rule of thumb, try what works best for you.
The main thread can remain in default, and the rest can be divided among workers.

If we have set only one worker then why are we getting heap size limit issue?

Because every worker has the nodejs default limit.

Do references held by previous renders get freed up after report rendering finishes?

nodejs is the garbage-collected runtime. So it gets cleaned from memory when the GC gets triggered by the runtime.

Hi, it is likely that in June 2026, the node VM module will enable us to sandbox ESM modules.

However, note that in the newer node, you will still be able to use CommonJS modules as of now.
In other words, that date, June 2026, shouldn't be significant for you.

This hasn’t been implemented yet, unfortunately — there were other priorities.

The xlsx recipe, when you use xlsxAdd, already use batching and streaming internally.
Do you hit an OOM error when having many rows?

Would you be able to email me the mentioned pdfs?