mirror of
https://github.com/vercel/chat.git
synced 2026-09-14 18:32:29 +08:00
feat/chatbot-cli
685 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 dancer
|
10d439057e | chore: add cli changeset | ||
|
dancer
|
5cead87abf | chore: merge main into cli branch | ||
|
dancer
|
fd6554d9ac | feat(cli): rename scaffold package | ||
|
mazhe-nerd
|
293356525d |
feat: docs: add Lark / Feishu adapter (#517)
## Summary Adds [`@larksuite/vercel-chat-adapter`](https://www.npmjs.com/package/@larksuite/vercel-chat-adapter), the Lark / Feishu adapter for Chat SDK, as a **vendor-official community adapter**. - **Package**: `@larksuite/vercel-chat-adapter` — published on npm under the official `larksuite` scope - **Built on**: [`@larksuiteoapi/node-sdk`](https://www.npmjs.com/package/@larksuiteoapi/node-sdk)'s `LarkChannel`, the official Lark Node SDK - **Docs source**: external README referenced by `adapters.json` lives in [`larksuite/node-sdk`](https://github.com/larksuite/node-sdk/tree/cbc4adf13cbcb93b389db01faf428e3b3cef053c/docs/vercel-chat-adapter) (the official Lark vendor-owned GitHub org, pinned at commit `cbc4adf1`); the in-tree MDX in this PR is the rendered detail page (`mdxBody: true`) - **Capabilities**: native cardkit typewriter streaming, interactive cards, reactions, edit / delete, message history (via SDK `normalize()`), DM detection, mention handling, and scan-to-create app onboarding through `registerLarkApp` ## Changes | File | Change | |---|---| | `apps/docs/adapters.json` | Add Lark / Feishu entry (`community: true`, `vendorOfficial: true`) | | `apps/docs/content/adapters/vendor-official/lark.mdx` | New hand-authored MDX detail page (frontmatter with full features matrix, install / quick start / configuration / transport / streaming / ID encoding / history / safety / limitations / FeatureSupport) | | `apps/docs/content/adapters/vendor-official/meta.json` | Append `"lark"` to the sidebar `pages` array | | `packages/integration-tests/src/docs-adapters.test.ts` | Append `"lark"` to the hardcoded vendor-official slug list asserted by `Vendor-Official adapter MDX › contains exactly the expected adapters` | No icon registered in `adapters.json` / `iconMap` / `adapterLogos` — matches the existing pattern for vendor-official adapters (Beeper, Resend, Liveblocks, Zernio, Photon). ## Vendor Official tier Per `docs/contributing/building.mdx` (Qualifications for vendor official tier): - ✅ **Commitment for continued maintenance** — owned by the Lark / Feishu team - ✅ **GitHub hosting in official vendor-owned org** — adapter README lives in [`larksuite/node-sdk`](https://github.com/larksuite/node-sdk), the official Lark org - ✅ **Documentation in primary vendor docs** — will be cross-linked from the official Lark Open Platform developer documentation - ✅ **Announcement** — will be announced through Lark developer changelog / channels ## A note on source visibility The adapter source is not currently open-sourced due to internal release-process requirements. What is public: - The npm package itself (consumable by any user) - The README, hosted in `larksuite/node-sdk` (official Lark org) - The underlying [`@larksuiteoapi/node-sdk`](https://github.com/larksuite/node-sdk) on which it is built — this *is* fully open-source ## Test plan - [x] `pnpm --filter docs build` — docs app builds cleanly; `/en/adapters/vendor-official/lark` and `/en/adapters/vendor-official/lark/og` routes are generated - [x] `pnpm typecheck` — passes (33 tasks) - [x] `pnpm check` (Ultracite / Biome) — 438 files, no fixes - [x] `pnpm --filter @chat-adapter/integration-tests test docs-adapters` — 232 tests pass (frontmatter, vendor-official roster, adapters.json ↔ MDX sync) - [x] Manual: `/adapters` lists the Lark / Feishu card in the **Vendor Official** section; `/adapters/vendor-official/lark` renders the MDX detail page with the FeatureSupport matrix |
||
|
Meet Modi
|
bd38498b60 |
docs(adapters): add AgentPhone as vendor-official adapter (#562)
## Summary Adds [AgentPhone](https://agentphone.to) as a vendor-official adapter in `adapters.json`. AgentPhone is the first Chat SDK adapter with unified support for **SMS, MMS, iMessage, and voice calls** in a single package: - **SMS/MMS** — send and receive via `agent.message` webhooks - **iMessage** — full support including tapback reactions (love, like, laugh, etc.) and expressive send styles - **Voice** — inbound/outbound call transcripts and summaries via `agent.call_ended` webhooks - **HMAC-SHA256** webhook verification with replay protection | | SMS | MMS | iMessage | Voice | |---|---|---|---|---| | Send messages | ✓ | ✓ | ✓ | — | | Receive messages | ✓ | ✓ | ✓ | — | | Media attachments | — | ✓ | ✓ | — | | Reactions | — | — | ✓ | — | | Call transcripts | — | — | — | ✓ | - **npm**: [`@agentphone/chat-sdk-adapter`](https://www.npmjs.com/package/@agentphone/chat-sdk-adapter) - **GitHub**: [`AgentPhone-AI/chat-sdk-adapter`](https://github.com/AgentPhone-AI/chat-sdk-adapter) - **Docs**: [docs.agentphone.ai](https://docs.agentphone.ai) |
||
|
Ben Sabic
|
9b8d8c4518 |
Discoverability lift: link KB guides, broaden npm keywords, mirror to AGENTS.md (#560)
Broad SEO/AEO pass across the docs site, adapter READMEs and AGENTS.md files, and npm package metadata so Chat SDK content shows up better in search engines, in LLM-driven package recommendations, and in IDE/coding-agent context. **Docs site** - Adds a `## Resources` section to the Getting Started and AI overview pages and to the Slack, Discord, GitHub, Liveblocks, and Sendblue adapter pages, each linking to applicable guides/templates with descriptions sourced from `resources-edge-config.json` and a cross-link back to the central `/resources` hub. **Adapter packages** - Mirrors the same Resources sections into the Slack, Discord, and GitHub READMEs (so they surface on npm) and into their AGENTS.md files (so coding agents see them alongside the API notes). - Expands `keywords` on every published adapter and state package — adds `chat-sdk`, `chatbot`, `ai-agent`, `ai-sdk`, `vercel`, plus platform-specific terms like `slack-bot`, `block-kit`, `slash-commands`, `github-app`, `whatsapp-business`, `state-adapter`. **Resources registry** - Registers four new entries in `resources-edge-config.json` (Human-in-the-Loop guide, Liveblocks AI agent guide, Slack + Vercel Blob guide, Durable iMessage Agent template) and runs `pnpm sync-resources` so the bundled `chat` package guides, `templates.json`, and `skills/chat/SKILL.md` all pick them up. - Fixes the synced Slack AI agent guide to import `toAiMessages` from `chat/ai` instead of the deprecated `chat` re-export path (the upstream KB source has also been updated, so future syncs will preserve this). **Drive-by fixes** - Resend adapter doc quick start: corrects `MemoryStateAdapter` class import to the `createMemoryState()` factory (matching every other adapter doc). - Zalo adapter doc: drops the "community adapter" callout that duplicated frontmatter. **Tooling / CI** - Adds `tsx` as a root devDependency so `pnpm sync-resources` works out of the box (it previously relied on `npx tsx`, which hung when not pre-cached). - Loosens the CI changeset gate to also skip `packages/chat/resources/` (generated data), matching the existing `*.md` carve-out. --------- Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com> |
||
|
luren
|
5461ea982b |
feat(telegram): add native DM draft streaming with segmented stream results (#340)
## Summary Add native Telegram DM streaming via `sendMessageDraft` while preserving Chat SDK's existing post+edit fallback for non-DM threads. This PR: - adds native private-chat draft streaming to the Telegram adapter - splits long streamed markdown into Telegram-safe persisted segments - retries without `parse_mode` when Telegram rejects markdown entity parsing - exposes segmented native stream results in the chat core - updates docs and feature matrices to reflect Telegram DM draft streaming --------- Co-authored-by: dancer <josh@afterima.ge> |
||
|
josh
|
6ed4a43897 |
feat(slack): add low-level interaction helpers (#559)
## summary adds lower-level Slack helpers for custom runtimes that already own routing, state, sessions, or workflow execution this expands the existing Slack subpaths with typed inbound files, richer interaction payload fields, thread reply fetching, modal opening, and generic input request Block Kit helpers it keeps the helpers on the existing `@chat-adapter/slack` package and preserves the runtime-light import boundary for `webhook`, `api`, and `blocks` |
||
|
Aradhya C P
|
177735a60f |
fix(gchat): collapse redundant autolink formatting for email links (#553)
## Description Fix redundant autolink rendering for email addresses in the Google Chat adapter. Previously, autolinked email addresses were rendered as `<mailto:...|...>` even when the visible text already matched the email address. This resulted in unnecessary verbose output. This change collapses such cases to plain text for cleaner and more consistent rendering. While testing, it was observed that `tel:` links are not currently generated from plain phone number inputs in the existing parsing pipeline. However, support for `tel:` handling has still been added in the implementation for future compatibility as referenced in the issue. <img width="757" height="107" alt="image" src="https://github.com/user-attachments/assets/a8ccfd6c-6669-4535-b733-5f2c185d9e2f" /> Additionally, new test cases have been added to cover email autolinks, labeled mailto links, and general markdown link behavior. ## Type of Change - [x] Bug fix (non-breaking change which fixes an issue) ## Related Issues Fixes #516 ## Changes Made - Collapsed redundant `mailto:` autolinks when visible text matches the email address - Added support for `tel:` scheme handling for future compatibility - Updated link rendering logic in Google Chat adapter markdown converter - Added and updated unit tests for email and link conversion cases ## Testing - [x] All existing tests pass - [x] Added new tests for the changes - [x] Manually tested the changes ### Test Coverage - Email autolink collapsing verified - Custom labeled mailto links verified - HTTP link formatting verified - Edge cases for link conversion verified via unit tests ## Screenshots/Demos N/A ## Checklist - [x] My code follows the project's code style - [x] I have performed a self-review of my own code - [x] I have commented my code, particularly in hard-to-understand areas - [x] I have made corresponding changes to the documentation - [x] My changes generate no new warnings or errors - [x] I have added tests that prove my fix is effective or that my feature works - [x] New and existing unit tests pass locally with my changes - [x] I have created a changeset (`pnpm changeset`) ## Changeset - [x] I have created a changeset for these changes ## Additional Notes During testing, `tel:` links were not observed in the current markdown parsing pipeline for plain phone numbers. However, support for `tel:` has been included to align with the issue description and for future-proofing the adapter behavior. --------- Co-authored-by: dancer <josh@afterima.ge> |
||
|
josh
|
25ebc3b925 |
feat(twilio): add sms, mms, and voice helpers (#558)
## summary adds a first-class Twilio adapter for SMS and MMS bots, plus low-level voice helpers for custom Twilio voice routes this includes webhook parsing and signature verification, outbound Messages API helpers, phone-number and Messaging Service sending, inbound MMS attachments with authenticated `fetchData`, plain text card fallback rendering, markdown conversion, and runtime-light `api`, `webhook`, `voice`, and `format` subpaths the adapter intentionally avoids the `twilio` npm runtime dependency so apps can use the low-level helpers without pulling in the full SDK |
||
|
josh
|
0488a6613c |
docs(slack): document low-level api subpaths (#557)
## summary documents the low-level Slack subpaths for custom runtimes that own routing, state, sessions, or workflow execution covers `@chat-adapter/slack/webhook`, `@chat-adapter/slack/format`, `@chat-adapter/slack/api`, and `@chat-adapter/slack/blocks`, including when to use them instead of the full `createSlackAdapter` runtime also links the new guide from the Slack adapter page |
||
|
josh
|
1294490755 |
refactor(slack): share provider helpers (#556)
## summary reuses the low-level Slack formatting helpers inside the high-level Slack adapter without changing adapter behavior this removes duplicated mrkdwn-to-markdown and markdown-bold conversion logic by sharing `slackMrkdwnToMarkdown`, `linkBareSlackMentions`, and `markdownBoldToSlackMrkdwn` across the format converter, card converter, and blocks subpath the low-level mention helper remains ID-based to match Slack docs, while the high-level adapter keeps its existing bare-name mention compatibility privately |
||
|
josh
|
dbd8dc5b7c |
feat(slack): expose block kit helpers (#555)
## summary exposes a runtime-free `@chat-adapter/slack/blocks` subpath for converting Chat SDK-style card objects into Slack Block Kit blocks the new subpath includes typed card input shapes, fallback text helpers, Slack emoji placeholder conversion, and docs-backed Slack limits for headers, images, actions, select options, fields, and tables this keeps lower-level Slack rendering reusable without importing the full Slack adapter, `chat`, `@chat-adapter/shared`, or Slack SDK runtime packages |
||
|
josh
|
aba6aa94fe |
feat(slack): add api primitives subpath (#548)
## summary adds `@chat-adapter/slack/api` for lightweight Slack Web API helpers the new subpath exposes fetch-based primitives for calling Slack Web API methods, posting and updating messages, sending response URL payloads, uploading files through Slack's external upload flow, and fetching private Slack file URLs with bearer auth it stays independent of the full Slack adapter runtime, Chat SDK runtime, Slack WebClient, Socket Mode, and shared adapter package, so lower-level runtimes can reuse Slack API correctness without adopting `createSlackAdapter` |
||
|
josh
|
4c46c26c75 |
feat(slack): add format primitives subpath (#547)
## summary adds `@chat-adapter/slack/format` for lightweight Slack formatting helpers the new subpath exposes runtime-free primitives for Slack text objects, mrkdwn escaping, mentions, links, dates, and basic mrkdwn normalization without importing the full Slack adapter, Chat SDK runtime, Slack SDK, Socket Mode, or shared adapter package this keeps the normal `@chat-adapter/slack` adapter path unchanged while giving lower-level runtimes a small typed API for Slack formatting correctness |
||
|
josh
|
b332a03d59 |
feat(slack): add webhook primitives subpath (#538)
## summary adds a lightweight `@chat-adapter/slack/webhook` subpath for lower-level Slack webhook handling without pulling in the full Slack adapter runtime this exposes primitives for verifying Slack requests, reading signed webhook bodies, parsing Events API callbacks, slash commands, and interactive payloads, and returning provider-native continuation data for message-like payloads this gives framework and infrastructure integrations a small Slack-owned surface they can use directly while keeping `chat`, Slack SDK clients, adapter state, dedupe, locks, and subscriptions out of the primitive path |
||
|
Malte Ubl
|
e4046e4518 | Add minimumReleaseAge to pnpm workspace config (2 days) (#544) | ||
|
dependabot[bot]
|
c3091eb9f9 |
build(deps): bump rollup from 4.54.0 to 4.60.4 (#525)
Bumps [rollup](https://github.com/rollup/rollup) from 4.54.0 to 4.60.4. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/rollup/rollup/releases">rollup's releases</a>.</em></p> <blockquote> <h2>v4.60.4</h2> <h2>4.60.4</h2> <p><em>2026-05-14</em></p> <h3>Bug Fixes</h3> <ul> <li>Improve stability of chunk hashes (<a href="https://redirect.github.com/rollup/rollup/issues/6362">#6362</a>)</li> </ul> <h3>Pull Requests</h3> <ul> <li><a href="https://redirect.github.com/rollup/rollup/pull/6362">#6362</a>: fix: stabilize chunk assignment across parallel file reads (<a href="https://github.com/sonukapoor"><code>@sonukapoor</code></a>, <a href="https://github.com/Sonu"><code>@Sonu</code></a> Kapoor, <a href="https://github.com/TrickyPi"><code>@TrickyPi</code></a>, <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6370">#6370</a>: fix(deps): update minor/patch updates (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6371">#6371</a>: chore(deps): update dependency lru-cache to v11 (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot], <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6372">#6372</a>: chore(deps): update react monorepo to v19 (major) (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6373">#6373</a>: chore(deps): lock file maintenance (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot], <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6375">#6375</a>: Resolve vulnerabilities (<a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> </ul> <h2>v4.60.2</h2> <h2>4.60.2</h2> <p><em>2026-04-18</em></p> <h3>Bug Fixes</h3> <ul> <li>Resolve a variable rendering bug when generating different formats from the same build (<a href="https://redirect.github.com/rollup/rollup/issues/6350">#6350</a>)</li> </ul> <h3>Pull Requests</h3> <ul> <li><a href="https://redirect.github.com/rollup/rollup/pull/6327">#6327</a>: docs: fix various typos in source and documentation (<a href="https://github.com/Abhi3975"><code>@Abhi3975</code></a>, <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6331">#6331</a>: fix(deps): update minor/patch updates (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6332">#6332</a>: chore(deps): update codecov/codecov-action action to v6 (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6333">#6333</a>: chore(deps): update dependency eslint-plugin-unicorn to v64 (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6334">#6334</a>: fix(deps): update rust crate swc_compiler_base to v51 (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6335">#6335</a>: chore(deps): lock file maintenance (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot], <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6346">#6346</a>: fix(deps): update minor/patch updates (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6347">#6347</a>: chore(deps): update dependency lru-cache to v11 (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6348">#6348</a>: fix(deps): update swc monorepo (major) (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot], <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6349">#6349</a>: chore(deps): lock file maintenance (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot], <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6350">#6350</a>: fix: reset variable render names between outputs in the same generate (<a href="https://github.com/barry3406"><code>@barry3406</code></a>, <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6351">#6351</a>: chore(deps): update minor/patch updates (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6352">#6352</a>: chore(deps): update cross-platform-actions/action action to v1 (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6353">#6353</a>: chore(deps): update dependency lru-cache to v11 (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot], <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6354">#6354</a>: chore(deps): lock file maintenance (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6355">#6355</a>: chore(deps): lock file maintenance (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6356">#6356</a>: chore(deps): lock file maintenance (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6358">#6358</a>: chore: remove cross-env from devDeps (<a href="https://github.com/K-tecchan"><code>@K-tecchan</code></a>)</li> </ul> <h2>v4.60.1</h2> <h2>4.60.1</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/rollup/rollup/blob/master/CHANGELOG.md">rollup's changelog</a>.</em></p> <blockquote> <h2>4.60.4</h2> <p><em>2026-05-14</em></p> <h3>Bug Fixes</h3> <ul> <li>Improve stability of chunk hashes (<a href="https://redirect.github.com/rollup/rollup/issues/6362">#6362</a>)</li> </ul> <h3>Pull Requests</h3> <ul> <li><a href="https://redirect.github.com/rollup/rollup/pull/6362">#6362</a>: fix: stabilize chunk assignment across parallel file reads (<a href="https://github.com/sonukapoor"><code>@sonukapoor</code></a>, <a href="https://github.com/Sonu"><code>@Sonu</code></a> Kapoor, <a href="https://github.com/TrickyPi"><code>@TrickyPi</code></a>, <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6370">#6370</a>: fix(deps): update minor/patch updates (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6371">#6371</a>: chore(deps): update dependency lru-cache to v11 (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot], <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6372">#6372</a>: chore(deps): update react monorepo to v19 (major) (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6373">#6373</a>: chore(deps): lock file maintenance (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot], <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6375">#6375</a>: Resolve vulnerabilities (<a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> </ul> <h2>4.60.3</h2> <p><em>2026-05-04</em></p> <h3>Bug Fixes</h3> <ul> <li>Ensure nested "exports" variables are not renamed (<a href="https://redirect.github.com/rollup/rollup/issues/6360">#6360</a>)</li> </ul> <h3>Pull Requests</h3> <ul> <li><a href="https://redirect.github.com/rollup/rollup/pull/6360">#6360</a>: fix: do not rename nested "exports" bindings that do not conflict (<a href="https://github.com/tariqrafique"><code>@tariqrafique</code></a>, <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6364">#6364</a>: chore(deps): update msys2/setup-msys2 digest to e989830 (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6365">#6365</a>: fix(deps): update minor/patch updates (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6366">#6366</a>: fix(deps): update swc monorepo (major) (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6367">#6367</a>: chore(deps): lock file maintenance (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot], <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6368">#6368</a>: docs: add missing backticks in <code>plugin-development</code> (<a href="https://github.com/lumirlumir"><code>@lumirlumir</code></a>, <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> </ul> <h2>4.60.2</h2> <p><em>2026-04-18</em></p> <h3>Bug Fixes</h3> <ul> <li>Resolve a variable rendering bug when generating different formats from the same build (<a href="https://redirect.github.com/rollup/rollup/issues/6350">#6350</a>)</li> </ul> <h3>Pull Requests</h3> <ul> <li><a href="https://redirect.github.com/rollup/rollup/pull/6327">#6327</a>: docs: fix various typos in source and documentation (<a href="https://github.com/Abhi3975"><code>@Abhi3975</code></a>, <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6331">#6331</a>: fix(deps): update minor/patch updates (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6332">#6332</a>: chore(deps): update codecov/codecov-action action to v6 (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6333">#6333</a>: chore(deps): update dependency eslint-plugin-unicorn to v64 (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6334">#6334</a>: fix(deps): update rust crate swc_compiler_base to v51 (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6335">#6335</a>: chore(deps): lock file maintenance (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot], <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/rollup/rollup/commit/d311a84b0bb4d4a6f50d19ffd2c29cca28660c88"><code>d311a84</code></a> 4.60.4</li> <li><a href="https://github.com/rollup/rollup/commit/6aa324854482e273b711972955d2d1b3bb445bcc"><code>6aa3248</code></a> fix: stabilize chunk assignment across parallel file reads (<a href="https://redirect.github.com/rollup/rollup/issues/6362">#6362</a>)</li> <li><a href="https://github.com/rollup/rollup/commit/82a0fe76b1372a2cf509fc4067d69f25569b83f5"><code>82a0fe7</code></a> Resolve vulnerabilities (<a href="https://redirect.github.com/rollup/rollup/issues/6375">#6375</a>)</li> <li><a href="https://github.com/rollup/rollup/commit/71f5ebc893d7ff76b5571d63b04ea2ed4a4ddd9d"><code>71f5ebc</code></a> chore(deps): update dependency lru-cache to v11 (<a href="https://redirect.github.com/rollup/rollup/issues/6371">#6371</a>)</li> <li><a href="https://github.com/rollup/rollup/commit/af91d778cdf564dd1ae1bfd6e92604ec031824a7"><code>af91d77</code></a> chore(deps): lock file maintenance (<a href="https://redirect.github.com/rollup/rollup/issues/6373">#6373</a>)</li> <li><a href="https://github.com/rollup/rollup/commit/65e7b94ddda9f02334fa8f12ff6bf699c1f07833"><code>65e7b94</code></a> chore(deps): update react monorepo to v19 (major) (<a href="https://redirect.github.com/rollup/rollup/issues/6372">#6372</a>)</li> <li><a href="https://github.com/rollup/rollup/commit/642587f3d9c5b4aa482a5027672f0fa8ea76da12"><code>642587f</code></a> fix(deps): update minor/patch updates (<a href="https://redirect.github.com/rollup/rollup/issues/6370">#6370</a>)</li> <li><a href="https://github.com/rollup/rollup/commit/b47bdabeccbb7aa1b1d4117f2f4a781a9f6de297"><code>b47bdab</code></a> 4.60.3</li> <li><a href="https://github.com/rollup/rollup/commit/15c5f33083c8c6b1b2cbae548124fffbba2553bb"><code>15c5f33</code></a> Add again some unneeded dev dependencies, to make some builds succeed</li> <li><a href="https://github.com/rollup/rollup/commit/12195dcebbd21f0f2d91e26720cd053526edbfe3"><code>12195dc</code></a> fix: do not rename nested "exports" bindings that do not conflict (<a href="https://redirect.github.com/rollup/rollup/issues/6360">#6360</a>)</li> <li>Additional commits viewable in <a href="https://github.com/rollup/rollup/compare/v4.54.0...v4.60.4">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
db61173386 |
build(deps-dev): bump postcss from 8.5.14 to 8.5.15 (#541)
Bumps [postcss](https://github.com/postcss/postcss) from 8.5.14 to 8.5.15. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/postcss/postcss/releases">postcss's releases</a>.</em></p> <blockquote> <h2>8.5.15</h2> <ul> <li>Fixed declaration parsing performance (by <a href="https://github.com/homanp"><code>@homanp</code></a>).</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/postcss/postcss/blob/main/CHANGELOG.md">postcss's changelog</a>.</em></p> <blockquote> <h2>8.5.15</h2> <ul> <li>Fixed declaration parsing performance (by <a href="https://github.com/homanp"><code>@homanp</code></a>).</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/postcss/postcss/commit/eae46db765d752cf8f40c4fa2b0b85030079c43d"><code>eae46db</code></a> Release 8.5.15 version</li> <li><a href="https://github.com/postcss/postcss/commit/79508ffa59e42c02056aca61b88bc393c8b516c4"><code>79508ff</code></a> Update CI actions</li> <li><a href="https://github.com/postcss/postcss/commit/b128e2131288a411c6e28071d0929542c49e74eb"><code>b128e21</code></a> Speed up declaration parsing by avoiding creating new array on each token</li> <li><a href="https://github.com/postcss/postcss/commit/9825dca02c33cf610e2a842be767468b67fbecf9"><code>9825dca</code></a> Fix code format</li> <li><a href="https://github.com/postcss/postcss/commit/55789c865281e2be194fa5b4e41dd046be3a2307"><code>55789c8</code></a> Update dependencies</li> <li><a href="https://github.com/postcss/postcss/commit/84fbbe9009cb3cc3bbb4cc3a9b65d468f4844d95"><code>84fbbe9</code></a> Install older pnpm action for old Node.js</li> <li><a href="https://github.com/postcss/postcss/commit/9f860bd78ec1dbc4f0ae72d693f03f956baa38cb"><code>9f860bd</code></a> Revert pnpm action for old Node.js</li> <li><a href="https://github.com/postcss/postcss/commit/08771986d47359545f502e009763e223b66bfcf6"><code>0877198</code></a> Update CI actions</li> <li><a href="https://github.com/postcss/postcss/commit/b2d1a335cea818f8b27e5cfb90147648afe3e582"><code>b2d1a33</code></a> Fix linter warnings</li> <li><a href="https://github.com/postcss/postcss/commit/0700dac92283bc259977dff2743ca74a00f58267"><code>0700dac</code></a> Merge pull request <a href="https://redirect.github.com/postcss/postcss/issues/2088">#2088</a> from rootvector2/add-oss-fuzz-harness</li> <li>Additional commits viewable in <a href="https://github.com/postcss/postcss/compare/8.5.14...8.5.15">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/vercel/chat/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
b4f3a00821 |
build(deps): bump ws from 8.18.3 to 8.20.1 (#539)
Bumps [ws](https://github.com/websockets/ws) from 8.18.3 to 8.20.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/websockets/ws/releases">ws's releases</a>.</em></p> <blockquote> <h2>8.20.1</h2> <h1>Bug fixes</h1> <ul> <li>Fixed an uninitialized memory disclosure issue in <code>websocket.close()</code> (c0327ec1).</li> </ul> <p>Providing a <code>TypedArray</code> (e.g. <code>Float32Array</code>) as the <code>reason</code> argument for <code>websocket.close()</code>, rather than the supported string or <code>Buffer</code> types, caused uninitialized memory to be disclosed to the remote peer.</p> <pre lang="js"><code>import { deepStrictEqual } from 'node:assert'; import { WebSocket, WebSocketServer } from 'ws'; <p>const wss = new WebSocketServer( { port: 0, skipUTF8Validation: true }, function () { const { port } = wss.address(); const ws = new WebSocket(<code>ws://localhost:${port}</code>, { skipUTF8Validation: true });</p> <pre><code>ws.on('close', function (code, reason) { deepStrictEqual(reason, Buffer.alloc(80)); }); </code></pre> <p>} );</p> <p>wss.on('connection', function (ws) { ws.close(1000, new Float32Array(20)); }); </code></pre></p> <p>The issue was privately reported by <a href="https://github.com/ChALkeR">Nikita Skovoroda</a>.</p> <h2>8.20.0</h2> <h1>Features</h1> <ul> <li>Added exports for the <code>PerMessageDeflate</code> class and utilities for the <code>Sec-WebSocket-Extensions</code> and <code>Sec-WebSocket-Protocol</code> headers (d3503c1f).</li> </ul> <h2>8.19.0</h2> <h1>Features</h1> <ul> <li>Added the <code>closeTimeout</code> option (<a href="https://redirect.github.com/websockets/ws/issues/2308">#2308</a>).</li> </ul> <h1>Bug fixes</h1> <ul> <li>Handled a forthcoming breaking change in Node.js core (19984854).</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/websockets/ws/commit/5d9b316230ea931532a6671cc450f18c11edd02f"><code>5d9b316</code></a> [dist] 8.20.1</li> <li><a href="https://github.com/websockets/ws/commit/c0327ec15a54d701eb6ccefaa8bef328cfc03086"><code>c0327ec</code></a> [security] Fix uninitialized memory disclosure in <code>websocket.close()</code></li> <li><a href="https://github.com/websockets/ws/commit/ce2a3d62437995a47e6056d485a33d21b6a8f867"><code>ce2a3d6</code></a> [ci] Test on node 26</li> <li><a href="https://github.com/websockets/ws/commit/58e45b872bb0f35a3edd553c27e105300a4f5bd0"><code>58e45b8</code></a> [ci] Do not test on node 25</li> <li><a href="https://github.com/websockets/ws/commit/5f26c245231a4b018479a9269e8c3da4773fe42f"><code>5f26c24</code></a> [ci] Run the lint step on node 24</li> <li><a href="https://github.com/websockets/ws/commit/843925544e2f4cffe445e0179947f56d6c5b608f"><code>8439255</code></a> [dist] 8.20.0</li> <li><a href="https://github.com/websockets/ws/commit/d3503c1fd36a310985108f62b343bae18346ab67"><code>d3503c1</code></a> [minor] Export the <code>PerMessageDeflate</code> class and header utils</li> <li><a href="https://github.com/websockets/ws/commit/3ee5349a0b1580f6e1f347b59ec3371011bd8481"><code>3ee5349</code></a> [api] Convert the <code>isServer</code> and <code>maxPayload</code> parameters to options</li> <li><a href="https://github.com/websockets/ws/commit/91707b470ebd803aaa3fd1e896217740f39267d4"><code>91707b4</code></a> [doc] Add missing space</li> <li><a href="https://github.com/websockets/ws/commit/8b553192268810a83253e2a4a39ac16768e75bb3"><code>8b55319</code></a> [pkg] Update eslint to version 10.0.1</li> <li>Additional commits viewable in <a href="https://github.com/websockets/ws/compare/8.18.3...8.20.1">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
63cd869f20 | build(deps-dev): bump turbo from 2.8.12 to 2.9.14 | ||
|
dependabot[bot]
|
39130a8898 | build(deps): bump vite from 7.3.1 to 7.3.3 | ||
|
josh
|
898b53af7c |
fix(ci): use supported node versions (#543)
## summary updates CI jobs that install pnpm to use Node versions compatible with the current repo package manager `Code Consistency` now follows `.nvmrc`, and the build/test matrix now runs on Node 22 and 24 instead of Node 20 and 24 this fixes the `node:sqlite` setup failure from running `pnpm@10.30.3` on Node 20 |
||
|
dependabot[bot]
|
10c58c2721 | build(deps): bump path-to-regexp from 0.1.13 to 8.4.2 | ||
|
dependabot[bot]
|
b18e99625e | build(deps): bump lodash from 4.17.21 to 4.18.1 | ||
|
dependabot[bot]
|
ceb1fdfa4b | build(deps): bump minimatch from 5.1.9 to 10.2.5 | ||
|
dependabot[bot]
|
4139283a17 | build(deps): bump picomatch from 2.3.1 to 4.0.4 | ||
|
dependabot[bot]
|
e4bd4a6ce8 | build(deps): bump axios from 1.13.6 to 1.16.1 | ||
|
josh
|
d7ace31cf2 |
fix(release): safely promote release branch (#522)
## summary updates the release workflow to promote the `release` branch with `--force-with-lease` the previous plain push could fail when `release` had remote history that was not present in the workflow checkout, even after packages published successfully this fetches the current `release` ref first, then updates it only if it still matches the fetched commit |
||
|
github-actions[bot]
|
6581d31507 |
chore(release): version packages (#469)
This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated. # Releases ## @chat-adapter/discord@4.29.0 ### Minor Changes -@chat-adapter/state-redis@4.29.0 @chat-adapter/github@4.29.0 @chat-adapter/web@4.29.0 @chat-adapter/state-ioredis@4.29.0 @chat-adapter/telegram@4.29.0 @chat-adapter/messenger@4.29.0 @chat-adapter/discord@4.29.0 @chat-adapter/slack@4.29.0 chat@4.29.0 @chat-adapter/linear@4.29.0 @chat-adapter/state-pg@4.29.0 @chat-adapter/tests@4.29.0 @chat-adapter/teams@4.29.0 @chat-adapter/shared@4.29.0 @chat-adapter/gchat@4.29.0 @chat-adapter/whatsapp@4.29.0 @chat-adapter/state-memory@4.29.0 |
||
|
josh
|
9d7891b2f5 |
fix(release): prevent accidental major bumps (#520)
## summary fixes the release plan so peer-dependent packages only trigger major bumps when the next dependency version falls outside their supported range this keeps the current release on `4.29.0` instead of accidentally bumping the fixed `chat` and `@chat-adapter/*` group to `5.0.0` also changes `@chat-adapter/tests` to use a real `chat` peer range while keeping `workspace:*` for local development |
||
|
josh
|
9f7bbc8482 |
fix(web): exclude framework wrappers from coverage (#512)
## summary excludes the Web adapter React, Vue, and Svelte wrapper entry points from coverage collection these files are thin framework-specific `useChat` wrappers that are already validated by build and typecheck, and excluding them avoids Vitest coverage trying to parse the Svelte wrapper as plain TypeScript |
||
|
dependabot[bot]
|
b93ffa78a1 |
build(deps-dev): bump svelte from 5.55.5 to 5.55.7 (#511)
Bumps [svelte](https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte) from 5.55.5 to 5.55.7. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sveltejs/svelte/releases">svelte's releases</a>.</em></p> <blockquote> <h2>svelte@5.55.7</h2> <h3>Patch Changes</h3> <ul> <li> <p>fix: prevent XSS on <code>hydratable</code> from user contents (<a href="https://github.com/sveltejs/svelte/commit/a16ebc67bbcf8f708360195687e1b2719463e1a4"><code>a16ebc67bbcf8f708360195687e1b2719463e1a4</code></a>)</p> </li> <li> <p>chore: bump devalue (<a href="https://redirect.github.com/sveltejs/svelte/pull/18219">#18219</a>)</p> </li> <li> <p>fix: disallow empty attribute names during SSR (<a href="https://github.com/sveltejs/svelte/commit/547853e2406a2147ad7fb5ffeba95b01bd9642da"><code>547853e2406a2147ad7fb5ffeba95b01bd9642da</code></a>)</p> </li> <li> <p>fix: harden regex (<a href="https://github.com/sveltejs/svelte/commit/d2375e2ebcab5c88feb5652f1a9d621b8f06b259"><code>d2375e2ebcab5c88feb5652f1a9d621b8f06b259</code></a>)</p> </li> <li> <p>fix: move Svelte runtime properties to symbols (<a href="https://github.com/sveltejs/svelte/commit/e1cbbd96441e82c9eb8a23a2903c0d06d3cda991"><code>e1cbbd96441e82c9eb8a23a2903c0d06d3cda991</code></a>)</p> </li> </ul> <h2>svelte@5.55.6</h2> <h3>Patch Changes</h3> <ul> <li> <p>fix: leave stale promises to wait for a later resolution, instead of rejecting (<a href="https://redirect.github.com/sveltejs/svelte/pull/18180">#18180</a>)</p> </li> <li> <p>fix: keep dependencies of <code>$state.eager/pending</code> (<a href="https://redirect.github.com/sveltejs/svelte/pull/18218">#18218</a>)</p> </li> <li> <p>fix: reapply context after transforming error during SSR (<a href="https://redirect.github.com/sveltejs/svelte/pull/18099">#18099</a>)</p> </li> <li> <p>fix: don't rebase just-created batches (<a href="https://redirect.github.com/sveltejs/svelte/pull/18117">#18117</a>)</p> </li> <li> <p>chore: allow <code>null</code> for <code>pending</code> in typings (<a href="https://redirect.github.com/sveltejs/svelte/pull/18201">#18201</a>)</p> </li> <li> <p>fix: flush eager effects in production (<a href="https://redirect.github.com/sveltejs/svelte/pull/18107">#18107</a>)</p> </li> <li> <p>fix: rethrow error of failed iterable after calling <code>return()</code> (<a href="https://redirect.github.com/sveltejs/svelte/pull/18169">#18169</a>)</p> </li> <li> <p>fix: account for proxified instance when updating <code>bind:this</code> (<a href="https://redirect.github.com/sveltejs/svelte/pull/18147">#18147</a>)</p> </li> <li> <p>fix: ensure scheduled batch is flushed if not obsolete (<a href="https://redirect.github.com/sveltejs/svelte/pull/18131">#18131</a>)</p> </li> <li> <p>fix: resolve stale deriveds with latest value (<a href="https://redirect.github.com/sveltejs/svelte/pull/18167">#18167</a>)</p> </li> <li> <p>chore: remove unnecessary <code>increment_pending</code> calls (<a href="https://redirect.github.com/sveltejs/svelte/pull/18183">#18183</a>)</p> </li> <li> <p>fix: correctly compile component member expressions for SSR (<a href="https://redirect.github.com/sveltejs/svelte/pull/18192">#18192</a>)</p> </li> <li> <p>fix: reset <code>source.updated</code> stack traces after <code>flush</code> (<a href="https://redirect.github.com/sveltejs/svelte/pull/18196">#18196</a>)</p> </li> <li> <p>fix: replacing async 'blocking' strategy with 'merging' (<a href="https://redirect.github.com/sveltejs/svelte/pull/18205">#18205</a>)</p> </li> <li> <p>fix: allow <code>@debug</code> tags to reference awaited variables (<a href="https://redirect.github.com/sveltejs/svelte/pull/18138">#18138</a>)</p> </li> <li> <p>fix: re-run fallback props if dependencies update (<a href="https://redirect.github.com/sveltejs/svelte/pull/18146">#18146</a>)</p> </li> <li> <p>fix: abort running obsolete async branches (<a href="https://redirect.github.com/sveltejs/svelte/pull/18118">#18118</a>)</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/sveltejs/svelte/blob/main/packages/svelte/CHANGELOG.md">svelte's changelog</a>.</em></p> <blockquote> <h2>5.55.7</h2> <h3>Patch Changes</h3> <ul> <li> <p>fix: prevent XSS on <code>hydratable</code> from user contents (<a href="https://github.com/sveltejs/svelte/commit/a16ebc67bbcf8f708360195687e1b2719463e1a4"><code>a16ebc67bbcf8f708360195687e1b2719463e1a4</code></a>)</p> </li> <li> <p>chore: bump devalue (<a href="https://redirect.github.com/sveltejs/svelte/pull/18219">#18219</a>)</p> </li> <li> <p>fix: disallow empty attribute names during SSR (<a href="https://github.com/sveltejs/svelte/commit/547853e2406a2147ad7fb5ffeba95b01bd9642da"><code>547853e2406a2147ad7fb5ffeba95b01bd9642da</code></a>)</p> </li> <li> <p>fix: harden regex (<a href="https://github.com/sveltejs/svelte/commit/d2375e2ebcab5c88feb5652f1a9d621b8f06b259"><code>d2375e2ebcab5c88feb5652f1a9d621b8f06b259</code></a>)</p> </li> <li> <p>fix: move Svelte runtime properties to symbols (<a href="https://github.com/sveltejs/svelte/commit/e1cbbd96441e82c9eb8a23a2903c0d06d3cda991"><code>e1cbbd96441e82c9eb8a23a2903c0d06d3cda991</code></a>)</p> </li> </ul> <h2>5.55.6</h2> <h3>Patch Changes</h3> <ul> <li> <p>fix: leave stale promises to wait for a later resolution, instead of rejecting (<a href="https://redirect.github.com/sveltejs/svelte/pull/18180">#18180</a>)</p> </li> <li> <p>fix: keep dependencies of <code>$state.eager/pending</code> (<a href="https://redirect.github.com/sveltejs/svelte/pull/18218">#18218</a>)</p> </li> <li> <p>fix: reapply context after transforming error during SSR (<a href="https://redirect.github.com/sveltejs/svelte/pull/18099">#18099</a>)</p> </li> <li> <p>fix: don't rebase just-created batches (<a href="https://redirect.github.com/sveltejs/svelte/pull/18117">#18117</a>)</p> </li> <li> <p>chore: allow <code>null</code> for <code>pending</code> in typings (<a href="https://redirect.github.com/sveltejs/svelte/pull/18201">#18201</a>)</p> </li> <li> <p>fix: flush eager effects in production (<a href="https://redirect.github.com/sveltejs/svelte/pull/18107">#18107</a>)</p> </li> <li> <p>fix: rethrow error of failed iterable after calling <code>return()</code> (<a href="https://redirect.github.com/sveltejs/svelte/pull/18169">#18169</a>)</p> </li> <li> <p>fix: account for proxified instance when updating <code>bind:this</code> (<a href="https://redirect.github.com/sveltejs/svelte/pull/18147">#18147</a>)</p> </li> <li> <p>fix: ensure scheduled batch is flushed if not obsolete (<a href="https://redirect.github.com/sveltejs/svelte/pull/18131">#18131</a>)</p> </li> <li> <p>fix: resolve stale deriveds with latest value (<a href="https://redirect.github.com/sveltejs/svelte/pull/18167">#18167</a>)</p> </li> <li> <p>chore: remove unnecessary <code>increment_pending</code> calls (<a href="https://redirect.github.com/sveltejs/svelte/pull/18183">#18183</a>)</p> </li> <li> <p>fix: correctly compile component member expressions for SSR (<a href="https://redirect.github.com/sveltejs/svelte/pull/18192">#18192</a>)</p> </li> <li> <p>fix: reset <code>source.updated</code> stack traces after <code>flush</code> (<a href="https://redirect.github.com/sveltejs/svelte/pull/18196">#18196</a>)</p> </li> <li> <p>fix: replacing async 'blocking' strategy with 'merging' (<a href="https://redirect.github.com/sveltejs/svelte/pull/18205">#18205</a>)</p> </li> <li> <p>fix: allow <code>@debug</code> tags to reference awaited variables (<a href="https://redirect.github.com/sveltejs/svelte/pull/18138">#18138</a>)</p> </li> <li> <p>fix: re-run fallback props if dependencies update (<a href="https://redirect.github.com/sveltejs/svelte/pull/18146">#18146</a>)</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sveltejs/svelte/commit/4d8f99a2709e3c02e48d8bc6c77458f4ba49d0e3"><code>4d8f99a</code></a> Version Packages (<a href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/18220">#18220</a>)</li> <li><a href="https://github.com/sveltejs/svelte/commit/05523088173e10af0753877af6936088de924833"><code>0552308</code></a> chore: bump devalue (<a href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/18219">#18219</a>)</li> <li><a href="https://github.com/sveltejs/svelte/commit/e1cbbd96441e82c9eb8a23a2903c0d06d3cda991"><code>e1cbbd9</code></a> Merge commit from fork</li> <li><a href="https://github.com/sveltejs/svelte/commit/a16ebc67bbcf8f708360195687e1b2719463e1a4"><code>a16ebc6</code></a> Merge commit from fork</li> <li><a href="https://github.com/sveltejs/svelte/commit/d2375e2ebcab5c88feb5652f1a9d621b8f06b259"><code>d2375e2</code></a> Merge commit from fork</li> <li><a href="https://github.com/sveltejs/svelte/commit/547853e2406a2147ad7fb5ffeba95b01bd9642da"><code>547853e</code></a> Merge commit from fork</li> <li><a href="https://github.com/sveltejs/svelte/commit/55f9c85c09d625c3dd80c71ce7542f57386fafb4"><code>55f9c85</code></a> Version Packages (<a href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/18158">#18158</a>)</li> <li><a href="https://github.com/sveltejs/svelte/commit/a10e8e47a5946623a60a1e36b9023c23926eae87"><code>a10e8e4</code></a> fix: keep dependencies of <code>$state.eager</code>/<code>pending</code> (alternative approach) (<a href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/1">#1</a>...</li> <li><a href="https://github.com/sveltejs/svelte/commit/ef4b97dfabfd7a23b27933e18f7393587c343d66"><code>ef4b97d</code></a> fix: duplicated "of" in events.js comment (<a href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/18217">#18217</a>)</li> <li><a href="https://github.com/sveltejs/svelte/commit/5122936edb3c14e9a602e579727479b49cbd3239"><code>5122936</code></a> fix: treat batches as a linked list (<a href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/18205">#18205</a>)</li> <li>Additional commits viewable in <a href="https://github.com/sveltejs/svelte/commits/svelte@5.55.7/packages/svelte">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
ee5e673fcd |
build(deps): bump devalue from 5.6.3 to 5.8.0 (#510)
Bumps [devalue](https://github.com/sveltejs/devalue) from 5.6.3 to 5.8.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sveltejs/devalue/releases">devalue's releases</a>.</em></p> <blockquote> <h2>v5.8.0</h2> <h3>Minor Changes</h3> <ul> <li>c5115b0: feat: add <code>stringifyAsync</code> for async serialization</li> </ul> <h2>v5.7.1</h2> <h3>Patch Changes</h3> <ul> <li>8becc7c: fix: handle regexes consistently in uneval's value and reference formats</li> </ul> <h2>v5.7.0</h2> <h3>Minor Changes</h3> <ul> <li>df2e284: feat: use native alternatives to encode/decode base64</li> <li>498656e: feat: add <code>DataView</code> support</li> <li>a210130: feat: whitelist <code>Float16Array</code></li> <li>df2e284: feat: simplify TypedArray slices</li> </ul> <h3>Patch Changes</h3> <ul> <li>5590634: fix: get <code>uneval</code> type handling up to parity with <code>stringify</code></li> <li>57f73fc: fix: correctly support boxed bigints and sentinel values</li> </ul> <h2>v5.6.4</h2> <h3>Patch Changes</h3> <ul> <li> <p>87c1f3c: fix: reject <code>__proto__</code> keys in malformed <code>Object</code> wrapper payloads</p> <p>This validates the <code>"Object"</code> parse path and throws when the wrapped value has an own <code>__proto__</code> key.</p> </li> <li> <p>40f1db1: fix: ensure sparse array indices are integers</p> </li> <li> <p>87c1f3c: fix: disallow <code>__proto__</code> keys in null-prototype object parsing</p> <p>This disallows <code>__proto__</code> keys in the <code>"null"</code> parse path so null-prototype object hydration cannot carry that key through parse/unflatten.</p> </li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/sveltejs/devalue/blob/main/CHANGELOG.md">devalue's changelog</a>.</em></p> <blockquote> <h2>5.8.0</h2> <h3>Minor Changes</h3> <ul> <li>c5115b0: feat: add <code>stringifyAsync</code> for async serialization</li> </ul> <h2>5.7.1</h2> <h3>Patch Changes</h3> <ul> <li>8becc7c: fix: handle regexes consistently in uneval's value and reference formats</li> </ul> <h2>5.7.0</h2> <h3>Minor Changes</h3> <ul> <li>df2e284: feat: use native alternatives to encode/decode base64</li> <li>498656e: feat: add <code>DataView</code> support</li> <li>a210130: feat: whitelist <code>Float16Array</code></li> <li>df2e284: feat: simplify TypedArray slices</li> </ul> <h3>Patch Changes</h3> <ul> <li>5590634: fix: get <code>uneval</code> type handling up to parity with <code>stringify</code></li> <li>57f73fc: fix: correctly support boxed bigints and sentinel values</li> </ul> <h2>5.6.4</h2> <h3>Patch Changes</h3> <ul> <li> <p>87c1f3c: fix: reject <code>__proto__</code> keys in malformed <code>Object</code> wrapper payloads</p> <p>This validates the <code>"Object"</code> parse path and throws when the wrapped value has an own <code>__proto__</code> key.</p> </li> <li> <p>40f1db1: fix: ensure sparse array indices are integers</p> </li> <li> <p>87c1f3c: fix: disallow <code>__proto__</code> keys in null-prototype object parsing</p> <p>This disallows <code>__proto__</code> keys in the <code>"null"</code> parse path so null-prototype object hydration cannot carry that key through parse/unflatten.</p> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sveltejs/devalue/commit/14933f78ff6b712829162628682b0a1993e75d19"><code>14933f7</code></a> Version Packages (<a href="https://redirect.github.com/sveltejs/devalue/issues/151">#151</a>)</li> <li><a href="https://github.com/sveltejs/devalue/commit/c5115b0074ec298fb4077f6cee5616cefbd13902"><code>c5115b0</code></a> feat: <code>stringifyAsync</code> (<a href="https://redirect.github.com/sveltejs/devalue/issues/150">#150</a>)</li> <li><a href="https://github.com/sveltejs/devalue/commit/67dad450b5db18ea9aa3059d334d8b0ee6704d9e"><code>67dad45</code></a> docs: update README to reflect serialization stability non-goal (<a href="https://redirect.github.com/sveltejs/devalue/issues/147">#147</a>)</li> <li><a href="https://github.com/sveltejs/devalue/commit/6eb920a7db6fe388f24f640d0e4e874a57f148fb"><code>6eb920a</code></a> Version Packages (<a href="https://redirect.github.com/sveltejs/devalue/issues/146">#146</a>)</li> <li><a href="https://github.com/sveltejs/devalue/commit/8becc7c436f0d4f85e2e5b32cb49dcfdf4fdec42"><code>8becc7c</code></a> fix: handle regexes consistently in uneval's value and reference formats (<a href="https://redirect.github.com/sveltejs/devalue/issues/145">#145</a>)</li> <li><a href="https://github.com/sveltejs/devalue/commit/2eee2e435ea0ea3d495dc7a266486df95a4eb6ed"><code>2eee2e4</code></a> Version Packages (<a href="https://redirect.github.com/sveltejs/devalue/issues/144">#144</a>)</li> <li><a href="https://github.com/sveltejs/devalue/commit/498656e75d36dfc63a386240722bdeac63337b25"><code>498656e</code></a> DataView support (<a href="https://redirect.github.com/sveltejs/devalue/issues/143">#143</a>)</li> <li><a href="https://github.com/sveltejs/devalue/commit/5590634db53ed555d3ce2e2024924b30352a6afc"><code>5590634</code></a> Improve platform types support (<a href="https://redirect.github.com/sveltejs/devalue/issues/142">#142</a>)</li> <li><a href="https://github.com/sveltejs/devalue/commit/57f73fc51389715d7ff27644b7b68e13397b6c1f"><code>57f73fc</code></a> fix: support boxed <code>bigint</code>s and sentinel values (<a href="https://redirect.github.com/sveltejs/devalue/issues/141">#141</a>)</li> <li><a href="https://github.com/sveltejs/devalue/commit/baec4cbcf1829de1d5da5d4512e4615186fe819e"><code>baec4cb</code></a> Add prettier configuration (<a href="https://redirect.github.com/sveltejs/devalue/issues/140">#140</a>)</li> <li>Additional commits viewable in <a href="https://github.com/sveltejs/devalue/compare/v5.6.3...v5.8.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/vercel/chat/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
a1416d35d3 |
build(deps): bump path-to-regexp from 0.1.13 to 8.4.2 (#509)
Bumps [path-to-regexp](https://github.com/pillarjs/path-to-regexp) from 0.1.13 to 8.4.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pillarjs/path-to-regexp/releases">path-to-regexp's releases</a>.</em></p> <blockquote> <h2>v8.4.2</h2> <p><strong>Fixed</strong></p> <ul> <li>Error on trailing backslash (<a href="https://redirect.github.com/pillarjs/path-to-regexp/issues/434">#434</a>) 9a78879</li> </ul> <p><strong>Performance</strong></p> <ul> <li>Minimize array allocations (<a href="https://redirect.github.com/pillarjs/path-to-regexp/issues/437">#437</a>) 937c02d</li> <li>Improve compile performance (<a href="https://redirect.github.com/pillarjs/path-to-regexp/issues/436">#436</a>) 57247e6 <ul> <li>Should improve compilation performance by ~25%</li> </ul> </li> <li>Remove internal tokenization during parse (<a href="https://redirect.github.com/pillarjs/path-to-regexp/issues/435">#435</a>) 5844988 <ul> <li>Should improve parse performance by ~20%</li> </ul> </li> </ul> <p><strong>Bundle size</strong> to 1.93 kB, from 1.97 kB.</p> <hr /> <p><a href="https://github.com/pillarjs/path-to-regexp/compare/v8.4.1...v8.4.2">https://github.com/pillarjs/path-to-regexp/compare/v8.4.1...v8.4.2</a></p> <h2>v8.4.1</h2> <p><strong>Fixed</strong></p> <ul> <li>Remove trie deduplication (<a href="https://redirect.github.com/pillarjs/path-to-regexp/issues/431">#431</a>) 6bc8e84 <ul> <li>Using a trie required non-greedy matching, which regressed wildcards in non-ending mode by matching them up until the first match. For example: <ul> <li><code>/*foo</code> with <code>/a/b</code> = <code>/a</code></li> <li><code>/*foo.html</code>with <code>/a/b.html/c.html</code> = <code>/a/b.html</code></li> </ul> </li> </ul> </li> <li>Allow backtrack handling to match itself (<a href="https://redirect.github.com/pillarjs/path-to-regexp/issues/427">#427</a>) 5bcd30b <ul> <li>When backtracking was introduced, it rejected matching things like <code>/:"a"_:"b"</code> against <code>/foo__</code>. This makes intuitive sense because the second parameter is not going to backtrack on <code>_</code> anymore, but it's somewhat unexpected since there's no reason it shouldn't match the second <code>_</code>.</li> </ul> </li> </ul> <hr /> <p><a href="https://github.com/pillarjs/path-to-regexp/compare/v8.4.0...v8.4.1">https://github.com/pillarjs/path-to-regexp/compare/v8.4.0...v8.4.1</a></p> <h2>v8.4.0</h2> <p><strong>Important</strong></p> <ul> <li>Fix <a href="https://www.cve.org/CVERecord?id=CVE-2026-4926">CVE-2026-4926</a> (<a href="https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-j3q9-mxjg-w52f">GHSA-j3q9-mxjg-w52f</a>)</li> <li>Fix <a href="https://www.cve.org/CVERecord?id=CVE-2026-4923">CVE-2026-4923</a> (<a href="https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-27v5-c462-wpq7">GHSA-27v5-c462-wpq7</a>)</li> </ul> <p><strong>Fixed</strong></p> <ul> <li>Restricts wildcard backtracking when using more than 1 in a path (<a href="https://redirect.github.com/pillarjs/path-to-regexp/pull/421">pillarjs/path-to-regexp#421</a>)</li> </ul> <p><strong>Changed</strong></p> <ul> <li>Dedupes regex prefixes (<a href="https://redirect.github.com/pillarjs/path-to-regexp/pull/422">pillarjs/path-to-regexp#422</a>) <ul> <li>This will result in shorter regular expressions for some cases using optional groups</li> </ul> </li> <li>Rejects large optional route combinations (<a href="https://redirect.github.com/pillarjs/path-to-regexp/pull/424">pillarjs/path-to-regexp#424</a>) <ul> <li>When using groups such as <code>/users{/delete}</code> it will restrict the number of generated combinations to < 256, equivalent to 8 top-level optional groups and unlikely to occur in a real world application, but avoids exploding the regex size for applications that accept user created routes</li> </ul> </li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/pillarjs/path-to-regexp/blob/master/History.md">path-to-regexp's changelog</a>.</em></p> <blockquote> <h1>Moved to <a href="https://github.com/pillarjs/path-to-regexp/releases">GitHub Releases</a></h1> <h2>3.0.0 / 2019-01-13</h2> <ul> <li>Always use prefix character as delimiter token, allowing any character to be a delimiter (e.g. <code>/:att1-:att2-:att3-:att4-:att5</code>)</li> <li>Remove <code>partial</code> support, prefer escaping the prefix delimiter explicitly (e.g. <code>\\/(apple-)?icon-:res(\\d+).png</code>)</li> </ul> <h2>2.4.0 / 2018-08-26</h2> <ul> <li>Support <code>start</code> option to disable anchoring from beginning of the string</li> </ul> <h2>2.3.0 / 2018-08-20</h2> <ul> <li>Use <code>delimiter</code> when processing repeated matching groups (e.g. <code>foo/bar</code> has no prefix, but has a delimiter)</li> </ul> <h2>2.2.1 / 2018-04-24</h2> <ul> <li>Allow empty string with <code>end: false</code> to match both relative and absolute paths</li> </ul> <h2>2.2.0 / 2018-03-06</h2> <ul> <li>Pass <code>token</code> as second argument to <code>encode</code> option (e.g. <code>encode(value, token)</code>)</li> </ul> <h2>2.1.0 / 2017-10-20</h2> <ul> <li>Handle non-ending paths where the final character is a delimiter <ul> <li>E.g. <code>/foo/</code> before required either <code>/foo/</code> or <code>/foo//</code> to match in non-ending mode</li> </ul> </li> </ul> <h2>2.0.0 / 2017-08-23</h2> <ul> <li>New option! Ability to set <code>endsWith</code> to match paths like <code>/test?query=string</code> up to the query string</li> <li>New option! Set <code>delimiters</code> for specific characters to be treated as parameter prefixes (e.g. <code>/:test</code>)</li> <li>Remove <code>isarray</code> dependency</li> <li>Explicitly handle trailing delimiters instead of trimming them (e.g. <code>/test/</code> is now treated as <code>/test/</code> instead of <code>/test</code> when matching)</li> <li>Remove overloaded <code>keys</code> argument that accepted <code>options</code></li> <li>Remove <code>keys</code> list attached to the <code>RegExp</code> output</li> <li>Remove asterisk functionality (it's a real pain to properly encode)</li> <li>Change <code>tokensToFunction</code> (e.g. <code>compile</code>) to accept an <code>encode</code> function for pretty encoding (e.g. pass your own implementation)</li> </ul> <h2>1.7.0 / 2016-11-08</h2> <ul> <li>Allow a <code>delimiter</code> option to be passed in with <code>tokensToRegExp</code> which will be used for "non-ending" token match situations</li> </ul> <h2>1.6.0 / 2016-10-03</h2> <ul> <li>Populate <code>RegExp.keys</code> when using the <code>tokensToRegExp</code> method (making it consistent with the main export)</li> <li>Allow a <code>delimiter</code> option to be passed in with <code>parse</code></li> <li>Updated TypeScript definition with <code>Keys</code> and <code>Options</code> updated</li> </ul> <h2>1.5.3 / 2016-06-15</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pillarjs/path-to-regexp/commit/cbf30259e6d34d6135f9e7dbaa3371e7188f9936"><code>cbf3025</code></a> 8.4.2</li> <li><a href="https://github.com/pillarjs/path-to-regexp/commit/937c02df571aef02832610100859efab21995320"><code>937c02d</code></a> Minimize array allocations (<a href="https://redirect.github.com/pillarjs/path-to-regexp/issues/437">#437</a>)</li> <li><a href="https://github.com/pillarjs/path-to-regexp/commit/57247e63fd061aa17b9f75c87712c680b223ee04"><code>57247e6</code></a> Improve compile performance (<a href="https://redirect.github.com/pillarjs/path-to-regexp/issues/436">#436</a>)</li> <li><a href="https://github.com/pillarjs/path-to-regexp/commit/58449883539022c9ac36ea3e9abb0fc7b9d84223"><code>5844988</code></a> Remove internal tokenization during parse (<a href="https://redirect.github.com/pillarjs/path-to-regexp/issues/435">#435</a>)</li> <li><a href="https://github.com/pillarjs/path-to-regexp/commit/9a788793e7eeb0ccf9c53c1cb54d297b5badfcc3"><code>9a78879</code></a> Error on trailing backslash (<a href="https://redirect.github.com/pillarjs/path-to-regexp/issues/434">#434</a>)</li> <li><a href="https://github.com/pillarjs/path-to-regexp/commit/7f058760ae0867fdd75e5ed07d7096f782c1f752"><code>7f05876</code></a> 8.4.1</li> <li><a href="https://github.com/pillarjs/path-to-regexp/commit/6bc8e84677caa52de6db7b2b17a6729ec155b070"><code>6bc8e84</code></a> Remove trie deduplication (<a href="https://redirect.github.com/pillarjs/path-to-regexp/issues/431">#431</a>)</li> <li><a href="https://github.com/pillarjs/path-to-regexp/commit/5bcd30b790fecfd4798521af28a57214996c4139"><code>5bcd30b</code></a> Allow backtrack handling to match itself (<a href="https://redirect.github.com/pillarjs/path-to-regexp/issues/427">#427</a>)</li> <li><a href="https://github.com/pillarjs/path-to-regexp/commit/9f9c6c501f6d015db3df224d2479475d59cac0a5"><code>9f9c6c5</code></a> Add parsing to benchmarks (<a href="https://redirect.github.com/pillarjs/path-to-regexp/issues/418">#418</a>)</li> <li><a href="https://github.com/pillarjs/path-to-regexp/commit/9fd31e0cde4f35b5f15f1676eabe3484618038ad"><code>9fd31e0</code></a> Add <code>trailing: false</code> tests (<a href="https://redirect.github.com/pillarjs/path-to-regexp/issues/428">#428</a>)</li> <li>Additional commits viewable in <a href="https://github.com/pillarjs/path-to-regexp/compare/v.0.1.13...v8.4.2">compare view</a></li> </ul> </details> <details> <summary>Install script changes</summary> <p>This version adds <code>prepare</code> script that runs during installation. Review the package contents before updating.</p> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/vercel/chat/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
76b28363b6 |
build(deps): bump undici from 6.21.3 to 7.22.0 (#508)
Bumps [undici](https://github.com/nodejs/undici) from 6.21.3 to 7.22.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/nodejs/undici/releases">undici's releases</a>.</em></p> <blockquote> <h2>v7.22.0</h2> <h2>What's Changed</h2> <ul> <li>docs: fix syntax highlighting in WebSocket.md by <a href="https://github.com/styfle"><code>@styfle</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4814">nodejs/undici#4814</a></li> <li>fix: use OR operator in includesCredentials per WHATWG URL Standard by <a href="https://github.com/jackhax"><code>@jackhax</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4816">nodejs/undici#4816</a></li> <li>feat(dispatcher/env-http-proxy-agent): strip leading dot and asterisk by <a href="https://github.com/SuperOleg39"><code>@SuperOleg39</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4676">nodejs/undici#4676</a></li> <li>fix: route WebSocket upgrades through onRequestUpgrade by <a href="https://github.com/mcollina"><code>@mcollina</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4787">nodejs/undici#4787</a></li> <li>build(deps-dev): bump esbuild from 0.25.12 to 0.27.3 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/nodejs/undici/pull/4821">nodejs/undici#4821</a></li> <li>fix(deduplicate): do not deduplicate non-safe methods by default by <a href="https://github.com/mcollina"><code>@mcollina</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4818">nodejs/undici#4818</a></li> <li>feat: Support async cache stores in revalidation by <a href="https://github.com/marcopiraccini"><code>@marcopiraccini</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4826">nodejs/undici#4826</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/jackhax"><code>@jackhax</code></a> made their first contribution in <a href="https://redirect.github.com/nodejs/undici/pull/4816">nodejs/undici#4816</a></li> <li><a href="https://github.com/marcopiraccini"><code>@marcopiraccini</code></a> made their first contribution in <a href="https://redirect.github.com/nodejs/undici/pull/4826">nodejs/undici#4826</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/nodejs/undici/compare/v7.21.0...v7.22.0">https://github.com/nodejs/undici/compare/v7.21.0...v7.22.0</a></p> <h2>v7.21.0</h2> <h2>What's Changed</h2> <ul> <li>build(deps): bump actions/setup-node from 6.0.0 to 6.2.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/nodejs/undici/pull/4796">nodejs/undici#4796</a></li> <li>test: restore global dispatcher after fetch tests by <a href="https://github.com/mcollina"><code>@mcollina</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4790">nodejs/undici#4790</a></li> <li>Add missing <code>close</code> method to WebSocketStream interface by <a href="https://github.com/piotr-cz"><code>@piotr-cz</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4802">nodejs/undici#4802</a></li> <li>fix: error stream instead of canceling by <a href="https://github.com/KhafraDev"><code>@KhafraDev</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4804">nodejs/undici#4804</a></li> <li>Fix clientTtl cleanup race in Agent by <a href="https://github.com/mcollina"><code>@mcollina</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4807">nodejs/undici#4807</a></li> <li>feat(<a href="https://redirect.github.com/nodejs/undici/issues/4230">#4230</a>): Implement pingInterval for dispatching PING frames by <a href="https://github.com/metcoder95"><code>@metcoder95</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4296">nodejs/undici#4296</a></li> <li>fix: handle undefined __filename in bundled environments by <a href="https://github.com/mcollina"><code>@mcollina</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4812">nodejs/undici#4812</a></li> <li>fix: set finalizer only for fetch responses by <a href="https://github.com/tsctx"><code>@tsctx</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4803">nodejs/undici#4803</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/piotr-cz"><code>@piotr-cz</code></a> made their first contribution in <a href="https://redirect.github.com/nodejs/undici/pull/4802">nodejs/undici#4802</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/nodejs/undici/compare/v7.20.0...v7.21.0">https://github.com/nodejs/undici/compare/v7.20.0...v7.21.0</a></p> <h2>v7.20.0</h2> <h2>What's Changed</h2> <ul> <li>fix: preserve fetch stack traces by <a href="https://github.com/mcollina"><code>@mcollina</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4778">nodejs/undici#4778</a></li> <li>Fix error handling in MockPool example by <a href="https://github.com/dave-kennedy"><code>@dave-kennedy</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4781">nodejs/undici#4781</a></li> <li>feat: expose statusText in request() ResponseData by <a href="https://github.com/domenic"><code>@domenic</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4784">nodejs/undici#4784</a></li> <li>test: reduce retry-after invalid date flake by <a href="https://github.com/mcollina"><code>@mcollina</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4788">nodejs/undici#4788</a></li> <li>extractBody fixes by <a href="https://github.com/KhafraDev"><code>@KhafraDev</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4791">nodejs/undici#4791</a></li> <li>fix: MockAgent delayed response with AbortSignal (<a href="https://redirect.github.com/nodejs/undici/issues/4693">#4693</a>) by <a href="https://github.com/mcollina"><code>@mcollina</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4772">nodejs/undici#4772</a></li> <li>fix: onParserTimeout potentially accessing undefined by <a href="https://github.com/vbfox"><code>@vbfox</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4758">nodejs/undici#4758</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/dave-kennedy"><code>@dave-kennedy</code></a> made their first contribution in <a href="https://redirect.github.com/nodejs/undici/pull/4781">nodejs/undici#4781</a></li> <li><a href="https://github.com/vbfox"><code>@vbfox</code></a> made their first contribution in <a href="https://redirect.github.com/nodejs/undici/pull/4758">nodejs/undici#4758</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/nodejs/undici/compare/v7.19.2...v7.20.0">https://github.com/nodejs/undici/compare/v7.19.2...v7.20.0</a></p> <h2>v7.19.2</h2> <h2>What's Changed</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/nodejs/undici/commit/0a236106a3a3e1b0aab424f71de2a68ca2c1d37b"><code>0a23610</code></a> Bumped v7.22.0 (<a href="https://redirect.github.com/nodejs/undici/issues/4829">#4829</a>)</li> <li><a href="https://github.com/nodejs/undici/commit/f3c5c614901e4ba29f2f60730c3d4f28e60a5186"><code>f3c5c61</code></a> feat: Support async cache stores in revalidation (<a href="https://redirect.github.com/nodejs/undici/issues/4826">#4826</a>)</li> <li><a href="https://github.com/nodejs/undici/commit/9b78a44eb21cabe0451263ef8e3cfc7ad8e40876"><code>9b78a44</code></a> fix(deduplicate): avoid deduping methods not in methods option (<a href="https://redirect.github.com/nodejs/undici/issues/4818">#4818</a>)</li> <li><a href="https://github.com/nodejs/undici/commit/0ce57bad2c171a16c043c8234317ef5383f86e0b"><code>0ce57ba</code></a> build(deps-dev): bump esbuild from 0.25.12 to 0.27.3 (<a href="https://redirect.github.com/nodejs/undici/issues/4821">#4821</a>)</li> <li><a href="https://github.com/nodejs/undici/commit/2453caf93824997c24383e5a84fddbfa783113b0"><code>2453caf</code></a> fix: route websocket upgrades through new handler API (<a href="https://redirect.github.com/nodejs/undici/issues/4787">#4787</a>)</li> <li><a href="https://github.com/nodejs/undici/commit/4658cdf5eacf3f6692ec96811a0e49e6b9bc060a"><code>4658cdf</code></a> feat(dispatcher/env-http-proxy-agent): strip leading dot and asterisk (<a href="https://redirect.github.com/nodejs/undici/issues/4676">#4676</a>)</li> <li><a href="https://github.com/nodejs/undici/commit/a821c5669fa653364649d8fb7b36957702c548f5"><code>a821c56</code></a> fix: use OR operator in includesCredentials per WHATWG URL Standard (<a href="https://redirect.github.com/nodejs/undici/issues/4816">#4816</a>)</li> <li><a href="https://github.com/nodejs/undici/commit/b3326b58969e2370a7da77d80dbad4df2f36ca1e"><code>b3326b5</code></a> docs: fix syntax highlighting in WebSocket.md (<a href="https://redirect.github.com/nodejs/undici/issues/4814">#4814</a>)</li> <li><a href="https://github.com/nodejs/undici/commit/393c0da68691a6da8ea0a774e38bcce2889be89e"><code>393c0da</code></a> Bumped v7.21.0 (<a href="https://redirect.github.com/nodejs/undici/issues/4813">#4813</a>)</li> <li><a href="https://github.com/nodejs/undici/commit/47f9b9664759d18d30c3c8f321425bee102e1df3"><code>47f9b96</code></a> fix: set finalizer only for fetch responses (<a href="https://redirect.github.com/nodejs/undici/issues/4803">#4803</a>)</li> <li>Additional commits viewable in <a href="https://github.com/nodejs/undici/compare/v6.21.3...v7.22.0">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for undici since your current version.</p> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/vercel/chat/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
5a1d98cd7e |
build(deps): bump minimatch from 5.1.9 to 10.2.5 (#507)
Bumps [minimatch](https://github.com/isaacs/minimatch) from 5.1.9 to 10.2.5. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/isaacs/minimatch/blob/main/changelog.md">minimatch's changelog</a>.</em></p> <blockquote> <h1>change log</h1> <h2>10.2</h2> <ul> <li>Add <code>braceExpandMax</code> option</li> </ul> <h2>10.1</h2> <ul> <li>Add <code>magicalBraces</code> option for <code>escape</code></li> <li>Fix <code>makeRe</code> when <code>partial: true</code> is set.</li> <li>Fix <code>makeRe</code> when pattern ends in a final <code>**</code> path part.</li> </ul> <h2>10.0</h2> <ul> <li>Require node 20 or 22 and higher</li> </ul> <h2>9.0</h2> <ul> <li>No default export, only named exports.</li> </ul> <h2>8.0</h2> <ul> <li>Recursive descent parser for extglob, allowing correct support for arbitrarily nested extglob expressions</li> <li>Bump required Node.js version</li> </ul> <h2>7.4</h2> <ul> <li>Add <code>escape()</code> method</li> <li>Add <code>unescape()</code> method</li> <li>Add <code>Minimatch.hasMagic()</code> method</li> </ul> <h2>7.3</h2> <ul> <li>Add support for posix character classes in a unicode-aware way.</li> </ul> <h2>7.2</h2> <ul> <li>Add <code>windowsNoMagicRoot</code> option</li> </ul> <h2>7.1</h2> <ul> <li>Add <code>optimizationLevel</code> configuration option, and revert the default back to the 6.2 style minimal optimizations, making the advanced transforms introduced in 7.0 opt-in. Also, process provided file paths in the same way in optimizationLevel:2 mode, so <em>most</em> things that matched with optimizationLevel 1 or 0 <em>should</em> match with level 2 as well. However, level 1 is the default, out of an abundance of caution.</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/isaacs/minimatch/commit/693c82377d0948401be4c6d3220c9a74132ab112"><code>693c823</code></a> 10.2.5</li> <li><a href="https://github.com/isaacs/minimatch/commit/7953af1fac53267c05e362f036b70de898318faa"><code>7953af1</code></a> do not allow .. to consume drive letter on Windows</li> <li><a href="https://github.com/isaacs/minimatch/commit/1caf91893b67586255c68e2e513b14ac66785a24"><code>1caf918</code></a> lint and format</li> <li><a href="https://github.com/isaacs/minimatch/commit/7783ed6670442acb4d455b9b164a1b2a33507a45"><code>7783ed6</code></a> ignore docs</li> <li><a href="https://github.com/isaacs/minimatch/commit/6d9b356cd59372de00e1d5f3b8907a3350b9b8e5"><code>6d9b356</code></a> update deps etc</li> <li><a href="https://github.com/isaacs/minimatch/commit/c36addb94e33f14254b9ca9017e63ae9c9d80d1d"><code>c36addb</code></a> 10.2.4</li> <li><a href="https://github.com/isaacs/minimatch/commit/26b90027d5ad0c383b5253a4e45d6dc7da282db4"><code>26b9002</code></a> docs: add warning about ReDoS</li> <li><a href="https://github.com/isaacs/minimatch/commit/3a0d83b6f03a17ebc15361c2faa7110777042aab"><code>3a0d83b</code></a> fix partial matching of globstar patterns</li> <li><a href="https://github.com/isaacs/minimatch/commit/ea94840326c3f40522f1b544bd2303024b0eec35"><code>ea94840</code></a> 10.2.3</li> <li><a href="https://github.com/isaacs/minimatch/commit/0873fbabc00a86e09f4469386059a71abb136c93"><code>0873fba</code></a> update deps</li> <li>Additional commits viewable in <a href="https://github.com/isaacs/minimatch/compare/v5.1.9...v10.2.5">compare view</a></li> </ul> </details> <details> <summary>Install script changes</summary> <p>This version adds <code>prepare</code> script that runs during installation. Review the package contents before updating.</p> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
5b44996390 |
build(deps): bump brace-expansion from 2.0.2 to 5.0.5 (#506)
Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) from 2.0.2 to 5.0.5. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/juliangruber/brace-expansion/releases">brace-expansion's releases</a>.</em></p> <blockquote> <h2>v4.0.1</h2> <ul> <li>fmt 5a5cc17</li> <li>Fix potential ReDoS Vulnerability or Inefficient Regular Expression (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/65">#65</a>) 0b6a978</li> </ul> <hr /> <p><a href="https://github.com/juliangruber/brace-expansion/compare/v4.0.0...v4.0.1">https://github.com/juliangruber/brace-expansion/compare/v4.0.0...v4.0.1</a></p> <h2>v4.0.0</h2> <ul> <li>feat: use string replaces instead of splits (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/64">#64</a>) 278132b</li> <li>fmt dd72a59</li> <li>add <code>tea.yaml</code> 70e4c1b</li> </ul> <p><a href="https://github.com/juliangruber/brace-expansion/compare/v3.0.0...v4.0.0">https://github.com/juliangruber/brace-expansion/compare/v3.0.0...v4.0.0</a></p> <p>As a precaution to not risk breaking anything with 278132b, this is a new semver major release</p> <h2>v3.0.1</h2> <ul> <li>pkg: publish on tag 3.x 3059c07</li> <li>fmt 8229e6f</li> <li>Fix potential ReDoS Vulnerability or Inefficient Regular Expression (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/65">#65</a>) 15f9b3c</li> </ul> <hr /> <p><a href="https://github.com/juliangruber/brace-expansion/compare/v3.0.0...v3.0.1">https://github.com/juliangruber/brace-expansion/compare/v3.0.0...v3.0.1</a></p> <h2>v3.0.0</h2> <ul> <li>Switch to ES Modules and balanced-match 3.0.0 (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/62">#62</a>) c0360e8</li> <li>added jsdoc (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/55">#55</a>) 68c0e37</li> <li>node 16 is EOL 9e781e9</li> <li>add standard 3494c4d</li> <li>use const and let (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/57">#57</a>) dd5a4cb</li> <li>docs 6dad209</li> <li>remove <code>test</code> e3dd8ae</li> <li>ci: update node versions d23ede9</li> <li>docs: add <a href="https://github.com/lanodan"><code>@lanodan</code></a> to contributors 1eb3fa4</li> <li>docs 1e7c9cd</li> <li>switch from tape to test module (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/60">#60</a>) 2520537</li> <li>Bump minimist from 1.2.5 to 1.2.6 (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/59">#59</a>) 61a94f1</li> <li>Bump path-parse from 1.0.6 to 1.0.7 (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/51">#51</a>) dc741cf</li> <li>docs: add back ci badge 8ee5626</li> <li>Add github actions, remove travis. Closes <a href="https://redirect.github.com/juliangruber/brace-expansion/issues/52">#52</a> (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/53">#53</a>) 5c8756a</li> <li>CI: Drop unused sudo: false Travis directive (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/50">#50</a>) 05978a7</li> </ul> <p><a href="https://github.com/juliangruber/brace-expansion/compare/v2.0.1...v3.0.0">https://github.com/juliangruber/brace-expansion/compare/v2.0.1...v3.0.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/juliangruber/brace-expansion/commit/87939017c6cb6be56b98c6fa2059b073315cd534"><code>8793901</code></a> 5.0.5</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051"><code>9a02af5</code></a> Merge commit from fork</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a"><code>daa71bc</code></a> Bump tar from 7.5.10 to 7.5.11 (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/92">#92</a>)</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/799e5f7a222b0ea29052090b80fab2125a846543"><code>799e5f7</code></a> Bump tar from 7.5.9 to 7.5.10 (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/90">#90</a>)</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/012c230b7f71ca0c43febfa2dc3b710f63f129dd"><code>012c230</code></a> 5.0.4</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/243c491714270462decf1293b395e0aa6f6c15c4"><code>243c491</code></a> Fix handling of brackets. Closes <a href="https://redirect.github.com/juliangruber/brace-expansion/issues/87">#87</a></li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/609f8588070198ca6ff7132d2f78bbae5c991b93"><code>609f858</code></a> Correct incorrect brace-expansion import (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/89">#89</a>)</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/3c51e2c3fd4af2e982f702e517fb6887cefdf509"><code>3c51e2c</code></a> 5.0.3</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/48c30d975c6b636383f9fc0c7f994f0b4da232d7"><code>48c30d9</code></a> chore: support node 18 (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/85">#85</a>)</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/d673911cfb1578bea6ea2df28b4a4bc37b191a5b"><code>d673911</code></a> Bump tar from 7.5.7 to 7.5.9 (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/84">#84</a>)</li> <li>Additional commits viewable in <a href="https://github.com/juliangruber/brace-expansion/compare/v2.0.2...v5.0.5">compare view</a></li> </ul> </details> <details> <summary>Install script changes</summary> <p>This version adds <code>prepare</code> script that runs during installation. Review the package contents before updating.</p> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/vercel/chat/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
fcb5018bb4 |
build(deps): bump picomatch from 2.3.1 to 4.0.4 (#505)
Bumps [picomatch](https://github.com/micromatch/picomatch) from 2.3.1 to 4.0.4. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/micromatch/picomatch/releases">picomatch's releases</a>.</em></p> <blockquote> <h2>4.0.4</h2> <p>This is a security release fixing several security relevant issues.</p> <h2>What's Changed</h2> <ul> <li>Fix for <a href="https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj">CVE-2026-33671</a></li> <li>Fix for <a href="https://github.com/micromatch/picomatch/security/advisories/GHSA-3v7f-55p6-f55p">CVE-2026-33672</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/micromatch/picomatch/compare/4.0.3...4.0.4">https://github.com/micromatch/picomatch/compare/4.0.3...4.0.4</a></p> <h2>4.0.3</h2> <h2>What's Changed</h2> <ul> <li>fix: exception when glob pattern contains <code>constructor</code> by <a href="https://github.com/Jason3S"><code>@Jason3S</code></a> in <a href="https://redirect.github.com/micromatch/picomatch/pull/144">micromatch/picomatch#144</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/Jason3S"><code>@Jason3S</code></a> made their first contribution in <a href="https://redirect.github.com/micromatch/picomatch/pull/144">micromatch/picomatch#144</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/micromatch/picomatch/compare/4.0.2...4.0.3">https://github.com/micromatch/picomatch/compare/4.0.2...4.0.3</a></p> <h2>3.0.2</h2> <p>This is a security release fixing several security relevant issues.</p> <h2>What's Changed</h2> <ul> <li>fix: exception when glob pattern contains constructor by <a href="https://github.com/Jason3S"><code>@Jason3S</code></a> in <a href="https://redirect.github.com/micromatch/picomatch/pull/144">micromatch/picomatch#144</a></li> <li>Fix for <a href="https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj">CVE-2026-33671</a></li> <li>Fix for <a href="https://github.com/micromatch/picomatch/security/advisories/GHSA-3v7f-55p6-f55p">CVE-2026-33672</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/micromatch/picomatch/compare/3.0.1...3.0.2">https://github.com/micromatch/picomatch/compare/3.0.1...3.0.2</a></p> <h2>2.3.2</h2> <p>This is a security release fixing several security relevant issues.</p> <h2>What's Changed</h2> <ul> <li>fix: exception when glob pattern contains constructor by <a href="https://github.com/Jason3S"><code>@Jason3S</code></a> in <a href="https://redirect.github.com/micromatch/picomatch/pull/144">micromatch/picomatch#144</a></li> <li>Fix for <a href="https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj">CVE-2026-33671</a></li> <li>Fix for <a href="https://github.com/micromatch/picomatch/security/advisories/GHSA-3v7f-55p6-f55p">CVE-2026-33672</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/micromatch/picomatch/compare/2.3.1...2.3.2">https://github.com/micromatch/picomatch/compare/2.3.1...2.3.2</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md">picomatch's changelog</a>.</em></p> <blockquote> <h1>Release history</h1> <p><strong>All notable changes to this project will be documented in this file.</strong></p> <p>The format is based on <a href="http://keepachangelog.com/en/1.0.0/">Keep a Changelog</a> and this project adheres to <a href="http://semver.org/spec/v2.0.0.html">Semantic Versioning</a>.</p> <!-- raw HTML omitted --> <ul> <li>Changelogs are for humans, not machines.</li> <li>There should be an entry for every single version.</li> <li>The same types of changes should be grouped.</li> <li>Versions and sections should be linkable.</li> <li>The latest version comes first.</li> <li>The release date of each versions is displayed.</li> <li>Mention whether you follow Semantic Versioning.</li> </ul> <!-- raw HTML omitted --> <!-- raw HTML omitted --> <p>Changelog entries are classified using the following labels <em>(from <a href="http://keepachangelog.com/">keep-a-changelog</a></em>):</p> <ul> <li><code>Added</code> for new features.</li> <li><code>Changed</code> for changes in existing functionality.</li> <li><code>Deprecated</code> for soon-to-be removed features.</li> <li><code>Removed</code> for now removed features.</li> <li><code>Fixed</code> for any bug fixes.</li> <li><code>Security</code> in case of vulnerabilities.</li> </ul> <!-- raw HTML omitted --> <h2>4.0.0 (2024-02-07)</h2> <h3>Fixes</h3> <ul> <li>Fix bad text values in parse <a href="https://redirect.github.com/micromatch/picomatch/issues/126">#126</a>, thanks to <a href="https://github.com/connor4312"><code>@connor4312</code></a></li> </ul> <h3>Changed</h3> <ul> <li>Remove process global to work outside of node <a href="https://redirect.github.com/micromatch/picomatch/issues/129">#129</a>, thanks to <a href="https://github.com/styfle"><code>@styfle</code></a></li> <li>Add sideEffects to package.json <a href="https://redirect.github.com/micromatch/picomatch/issues/128">#128</a>, thanks to <a href="https://github.com/frandiox"><code>@frandiox</code></a></li> <li>Removed <code>os</code>, make compatible browser environment. See <a href="https://redirect.github.com/micromatch/picomatch/issues/124">#124</a>, thanks to <a href="https://github.com/gwsbhqt"><code>@gwsbhqt</code></a></li> </ul> <h2>3.0.1</h2> <h3>Fixes</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/micromatch/picomatch/commit/e5474fc1a4d7991870058170407dda8a42be5334"><code>e5474fc</code></a> Publish 4.0.4</li> <li><a href="https://github.com/micromatch/picomatch/commit/4516eb521f13a46b2fe1a1d2c9ef6b20ddc0e903"><code>4516eb5</code></a> Merge commit from fork</li> <li><a href="https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d"><code>5eceecd</code></a> Merge commit from fork</li> <li><a href="https://github.com/micromatch/picomatch/commit/0db7dd70651ca7c8265601c0442a996ed32e3238"><code>0db7dd7</code></a> Run benchmark again against latest minimatch version (<a href="https://redirect.github.com/micromatch/picomatch/issues/161">#161</a>)</li> <li><a href="https://github.com/micromatch/picomatch/commit/95003777eb1c60dec09495a8231fa2ba4054d76a"><code>9500377</code></a> docs: clarify what brace expansion syntax is and isn't supported (<a href="https://redirect.github.com/micromatch/picomatch/issues/134">#134</a>)</li> <li><a href="https://github.com/micromatch/picomatch/commit/2661f23eca86c8b4a2b14815b9b2b3b74bd5a171"><code>2661f23</code></a> fix typo in globstars.js test name (<a href="https://redirect.github.com/micromatch/picomatch/issues/138">#138</a>)</li> <li><a href="https://github.com/micromatch/picomatch/commit/1798b07e9df59500b9cf567294d44d559032f4c7"><code>1798b07</code></a> docs: fix <code>makeRe</code> example (<a href="https://redirect.github.com/micromatch/picomatch/issues/143">#143</a>)</li> <li><a href="https://github.com/micromatch/picomatch/commit/9d76bc57a03b7f57cc4ca516c8071daf632bafd8"><code>9d76bc5</code></a> chore: undocument removed options (<a href="https://redirect.github.com/micromatch/picomatch/issues/146">#146</a>)</li> <li><a href="https://github.com/micromatch/picomatch/commit/e4d718bbfb47e4f030ab2612b5b04a9297fe272d"><code>e4d718b</code></a> Remove unused time-require (<a href="https://redirect.github.com/micromatch/picomatch/issues/160">#160</a>)</li> <li><a href="https://github.com/micromatch/picomatch/commit/38dffeb16221cc8eb8981524fb6895dd2aaaba76"><code>38dffeb</code></a> chore(deps): pin dependencies (<a href="https://redirect.github.com/micromatch/picomatch/issues/158">#158</a>)</li> <li>Additional commits viewable in <a href="https://github.com/micromatch/picomatch/compare/2.3.1...4.0.4">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
145dc63fd5 |
build(deps): bump axios from 1.13.6 to 1.15.0 (#504)
Bumps [axios](https://github.com/axios/axios) from 1.13.6 to 1.15.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/axios/axios/releases">axios's releases</a>.</em></p> <blockquote> <h2>v1.15.0</h2> <p>This release delivers two critical security patches, adds runtime support for Deno and Bun, and includes significant CI hardening, documentation improvements, and routine dependency updates.</p> <h2>⚠️ Important Changes</h2> <ul> <li><strong>Deprecation:</strong> <code>url.parse()</code> usage has been replaced to address Node.js deprecation warnings. If you are on a recent version of Node.js, this resolves console warnings you may have been seeing. (<strong><a href="https://redirect.github.com/axios/axios/issues/10625">#10625</a></strong>)</li> </ul> <h2>🔒 Security Fixes</h2> <ul> <li><strong>Proxy Handling:</strong> Fixed a <code>no_proxy</code> hostname normalisation bypass that could lead to Server-Side Request Forgery (SSRF). (<strong><a href="https://redirect.github.com/axios/axios/issues/10661">#10661</a></strong>)</li> <li><strong>Header Injection:</strong> Fixed an unrestricted cloud metadata exfiltration vulnerability via a header injection chain. (<strong><a href="https://redirect.github.com/axios/axios/issues/10660">#10660</a></strong>)</li> </ul> <h2>🚀 New Features</h2> <ul> <li><strong>Runtime Support:</strong> Added compatibility checks and documentation for Deno and Bun environments. (<strong><a href="https://redirect.github.com/axios/axios/issues/10652">#10652</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10653">#10653</a></strong>)</li> </ul> <h2>🔧 Maintenance & Chores</h2> <ul> <li><strong>CI Security:</strong> Hardened workflow permissions to least privilege, added the <code>zizmor</code> security scanner, pinned action versions, and gated npm publishing with OIDC and environment protection. (<strong><a href="https://redirect.github.com/axios/axios/issues/10618">#10618</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10619">#10619</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10627">#10627</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10637">#10637</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10666">#10666</a></strong>)</li> <li><strong>Dependencies:</strong> Bumped <code>serialize-javascript</code>, <code>handlebars</code>, <code>picomatch</code>, <code>vite</code>, and <code>denoland/setup-deno</code> to latest versions. Added a 7-day Dependabot cooldown period. (<strong><a href="https://redirect.github.com/axios/axios/issues/10574">#10574</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10572">#10572</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10568">#10568</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10663">#10663</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10664">#10664</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10665">#10665</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10669">#10669</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10670">#10670</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10616">#10616</a></strong>)</li> <li><strong>Documentation:</strong> Unified docs, improved <code>beforeRedirect</code> credential leakage example, clarified <code>withCredentials</code>/<code>withXSRFToken</code> behaviour, HTTP/2 support notes, async/await timeout error handling, header case preservation, and various typo fixes. (<strong><a href="https://redirect.github.com/axios/axios/issues/10649">#10649</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10624">#10624</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/7452">#7452</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/7471">#7471</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10654">#10654</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10644">#10644</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10589">#10589</a></strong>)</li> <li><strong>Housekeeping:</strong> Removed stale files, regenerated lockfile, and updated sponsor scripts and blocks. (<strong><a href="https://redirect.github.com/axios/axios/issues/10584">#10584</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10650">#10650</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10582">#10582</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10640">#10640</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10659">#10659</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10668">#10668</a></strong>)</li> <li><strong>Tests:</strong> Added regression coverage for urlencoded <code>Content-Type</code> casing. (<strong><a href="https://redirect.github.com/axios/axios/issues/10573">#10573</a></strong>)</li> </ul> <h2>🌟 New Contributors</h2> <p>We are thrilled to welcome our new contributors. Thank you for helping improve Axios:</p> <ul> <li><strong><a href="https://github.com/raashish1601"><code>@raashish1601</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10573">#10573</a></strong>)</li> <li><strong><a href="https://github.com/Kilros0817"><code>@Kilros0817</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10625">#10625</a></strong>)</li> <li><strong><a href="https://github.com/ashstrc"><code>@ashstrc</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10624">#10624</a></strong>)</li> <li><strong><a href="https://github.com/Abhi3975"><code>@Abhi3975</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10589">#10589</a></strong>)</li> <li><strong><a href="https://github.com/theamodhshetty"><code>@theamodhshetty</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/7452">#7452</a></strong>)</li> </ul> <h2>v1.14.0</h2> <p>This release focuses on compatibility fixes, adapter stability improvements, and test/tooling modernisation.</p> <h2>⚠️ Important Changes</h2> <ul> <li><strong>Breaking Changes:</strong> None identified in this release.</li> <li><strong>Action Required:</strong> If you rely on env-based proxy behaviour or CJS resolution edge-cases, validate your integration after upgrade (notably <code>proxy-from-env</code> v2 alignment and <code>main</code> entry compatibility fix).</li> </ul> <h2>🚀 New Features</h2> <ul> <li><strong>Runtime Features:</strong> No new end-user features were introduced in this release.</li> <li><strong>Test Coverage Expansion:</strong> Added broader smoke/module test coverage for CJS and ESM package usage. (<a href="https://redirect.github.com/axios/axios/pull/7510">#7510</a>)</li> </ul> <h2>🐛 Bug Fixes</h2> <ul> <li><strong>Headers:</strong> Trim trailing CRLF in normalised header values. (<a href="https://redirect.github.com/axios/axios/pull/7456">#7456</a>)</li> <li><strong>HTTP/2:</strong> Close detached HTTP/2 sessions on timeout to avoid lingering sessions. (<a href="https://redirect.github.com/axios/axios/pull/7457">#7457</a>)</li> <li><strong>Fetch Adapter:</strong> Cancel <code>ReadableStream</code> created during request-stream capability probing to prevent async resource leaks. (<a href="https://redirect.github.com/axios/axios/pull/7515">#7515</a>)</li> <li><strong>Proxy Handling:</strong> Fixed env proxy behavior with <code>proxy-from-env</code> v2 usage. (<a href="https://redirect.github.com/axios/axios/pull/7499">#7499</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/axios/axios/blob/v1.x/CHANGELOG.md">axios's changelog</a>.</em></p> <blockquote> <h2>v1.15.0 - April 7, 2026</h2> <p>This release delivers two critical security patches targeting header injection and SSRF via proxy bypass, adds official runtime support for Deno and Bun, and includes significant CI security hardening.</p> <h2>🔒 Security Fixes</h2> <ul> <li> <p><strong>Header Injection (CRLF):</strong> Rejects any header value containing <code>\r</code> or <code>\n</code> characters to block CRLF injection chains that could be used to exfiltrate cloud metadata (IMDS). Behavior change: headers with CR/LF now throw <code>"Invalid character in header content"</code>. (<strong><a href="https://redirect.github.com/axios/axios/issues/10660">#10660</a></strong>)</p> </li> <li> <p><strong>SSRF via <code>no_proxy</code> Bypass:</strong> Introduces a <code>shouldBypassProxy</code> helper that normalises hostnames (strips trailing dots, handles bracketed IPv6) before evaluating <code>no_proxy</code>/<code>NO_PROXY</code> rules, closing a gap that could cause loopback or internal hosts to be inadvertently proxied. (<strong><a href="https://redirect.github.com/axios/axios/issues/10661">#10661</a></strong>)</p> </li> </ul> <h2>🚀 New Features</h2> <ul> <li><strong>Deno & Bun Runtime Support:</strong> Added full smoke test suites for Deno and Bun, with CI workflows that run both runtimes before any release is cut. (<strong><a href="https://redirect.github.com/axios/axios/issues/10652">#10652</a></strong>)</li> </ul> <h2>🐛 Bug Fixes</h2> <ul> <li><strong>Node.js v22 Compatibility:</strong> Replaced deprecated <code>url.parse()</code> calls with the WHATWG <code>URL</code>/<code>URLSearchParams</code> API across examples, sandbox, and tests, eliminating <code>DEP0169</code> deprecation warnings on Node.js v22+. (<strong><a href="https://redirect.github.com/axios/axios/issues/10625">#10625</a></strong>)</li> </ul> <h2>🔧 Maintenance & Chores</h2> <ul> <li> <p><strong>CI Security Hardening:</strong> Added <a href="https://github.com/zizmorcore/zizmor">zizmor</a> GitHub Actions security scanner; switched npm publish to OIDC Trusted Publishing (removing the long-lived <code>NODE_AUTH_TOKEN</code>); pinned all action references to full commit SHAs; narrowed workflow permissions to least privilege; gated the publish step behind a dedicated <code>npm-publish</code> environment; and blocked the sponsor-block workflow from running on forks. (<strong><a href="https://redirect.github.com/axios/axios/issues/10618">#10618</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10619">#10619</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10627">#10627</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10637">#10637</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10641">#10641</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10666">#10666</a></strong>)</p> </li> <li> <p><strong>Docs:</strong> Clarified HTTP/2 support and the unsupported <code>httpVersion</code> option; added documentation for header case preservation; improved the <code>beforeRedirect</code> example to prevent accidental credential leakage. (<strong><a href="https://redirect.github.com/axios/axios/issues/10644">#10644</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10654">#10654</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10624">#10624</a></strong>)</p> </li> <li> <p><strong>Dependencies:</strong> Bumped <code>picomatch</code>, <code>handlebars</code>, <code>serialize-javascript</code>, <code>vite</code> (×3), <code>denoland/setup-deno</code>, and 4 additional dev dependencies to latest versions. (<strong><a href="https://redirect.github.com/axios/axios/issues/10564">#10564</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10565">#10565</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10567">#10567</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10568">#10568</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10572">#10572</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10574">#10574</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10663">#10663</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10664">#10664</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10665">#10665</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10669">#10669</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10670">#10670</a></strong>)</p> </li> </ul> <h2>🌟 New Contributors</h2> <p>We are thrilled to welcome our new contributors. Thank you for helping improve axios:</p> <ul> <li><strong><a href="https://github.com/Kilros0817"><code>@Kilros0817</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10625">#10625</a></strong>)</li> <li><strong><a href="https://github.com/shaanmajid"><code>@shaanmajid</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10616">#10616</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10617">#10617</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10618">#10618</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10619">#10619</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10637">#10637</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10641">#10641</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10666">#10666</a></strong>)</li> <li><strong><a href="https://github.com/ashstrc"><code>@ashstrc</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10624">#10624</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10644">#10644</a></strong>)</li> <li><strong><a href="https://github.com/Abhi3975"><code>@Abhi3975</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10589">#10589</a></strong>)</li> <li><strong><a href="https://github.com/raashish1601"><code>@raashish1601</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10573">#10573</a></strong>)</li> </ul> <p><a href="https://github.com/axios/axios/compare/v1.14.0...v1.15.0">Full Changelog</a></p> <hr /> <h2>v1.14.0 - March 27, 2026</h2> <p>This release fixes a security vulnerability in the <code>formidable</code> dependency, resolves a CommonJS compatibility regression, hardens proxy and HTTP/2 handling, and modernises the build and test toolchain.</p> <h2>🔒 Security Fixes</h2> <ul> <li><strong>Formidable Vulnerability:</strong> Upgraded <code>formidable</code> from v2 to v3 to address a reported arbitrary-file vulnerability. Updated test server and assertions to align with the v3 API. (<strong><a href="https://redirect.github.com/axios/axios/issues/7533">#7533</a></strong>)</li> </ul> <h2>🐛 Bug Fixes</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/axios/axios/commit/772a4e54ecc4cc2421e2b746daff0aca10f359d7"><code>772a4e5</code></a> chore(release): prepare release 1.15.0 (<a href="https://redirect.github.com/axios/axios/issues/10671">#10671</a>)</li> <li><a href="https://github.com/axios/axios/commit/4b071371be2f810b4bc7797a13838e0f806ebb22"><code>4b07137</code></a> chore(deps-dev): bump vite from 8.0.0 to 8.0.5 in /tests/smoke/esm (<a href="https://redirect.github.com/axios/axios/issues/10663">#10663</a>)</li> <li><a href="https://github.com/axios/axios/commit/51e57b39db251bfe3d34af5c943dfea18e06c8b6"><code>51e57b3</code></a> chore(deps-dev): bump vite from 8.0.2 to 8.0.5 (<a href="https://redirect.github.com/axios/axios/issues/10664">#10664</a>)</li> <li><a href="https://github.com/axios/axios/commit/fba1a77930f0c459677b729161627234b88c90aa"><code>fba1a77</code></a> chore(deps-dev): bump vite from 8.0.2 to 8.0.5 in /tests/module/esm (<a href="https://redirect.github.com/axios/axios/issues/10665">#10665</a>)</li> <li><a href="https://github.com/axios/axios/commit/0bf6e28eac86e87da2b60bbf5ea4237910e1a08e"><code>0bf6e28</code></a> chore(deps): bump denoland/setup-deno in the github-actions group (<a href="https://redirect.github.com/axios/axios/issues/10669">#10669</a>)</li> <li><a href="https://github.com/axios/axios/commit/8107157c572ee4a54cb28c01ab7f7f3d895ba661"><code>8107157</code></a> chore(deps-dev): bump the development_dependencies group with 4 updates (<a href="https://redirect.github.com/axios/axios/issues/10670">#10670</a>)</li> <li><a href="https://github.com/axios/axios/commit/e66530e3302d56176befd0778155dafea2487542"><code>e66530e</code></a> ci: require npm-publish environment for releases (<a href="https://redirect.github.com/axios/axios/issues/10666">#10666</a>)</li> <li><a href="https://github.com/axios/axios/commit/49f23cbfe4d308a075281c5f798d4c68f648cbe2"><code>49f23cb</code></a> chore(sponsor): update sponsor block (<a href="https://redirect.github.com/axios/axios/issues/10668">#10668</a>)</li> <li><a href="https://github.com/axios/axios/commit/363185461b90b1b78845dc8a99a1f103d9b122a1"><code>3631854</code></a> fix: unrestricted cloud metadata exfiltration via header injection chain (<a href="https://redirect.github.com/axios/axios/issues/10">#10</a>...</li> <li><a href="https://github.com/axios/axios/commit/fb3befb6daac6cad26b2e54094d0f2d9e47f24df"><code>fb3befb</code></a> fix: no_proxy hostname normalization bypass leads to ssrf (<a href="https://redirect.github.com/axios/axios/issues/10661">#10661</a>)</li> <li>Additional commits viewable in <a href="https://github.com/axios/axios/compare/v1.13.6...v1.15.0">compare view</a></li> </ul> </details> <details> <summary>Install script changes</summary> <p>This version modifies <code>prepare</code> script that runs during installation. Review the package contents before updating.</p> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
c9559c89ee |
build(deps): bump next from 16.2.3 to 16.2.6 (#488)
Bumps [next](https://github.com/vercel/next.js) from 16.2.3 to 16.2.6. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vercel/next.js/releases">next's releases</a>.</em></p> <blockquote> <h2>v16.2.6</h2> <blockquote> <p>[!NOTE] This release contains security fixes and backported bug fixes. It does <strong>not</strong> include all pending features/changes on canary.</p> </blockquote> <h3>Security Fixes</h3> <p>The following advisories have been addressed:</p> <p><strong>High:</strong></p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-8h8q-6873-q5fj">GHSA-8h8q-6873-q5fj: Denial of Service with Server Components</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f">GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-26hh-7cqf-hhc6">GHSA-26hh-7cqf-hhc6: Middleware / Proxy bypass in App Router applications via segment-prefetch routes - <strong>Incomplete Fix Follow-Up</strong></a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-mg66-mrh9-m8jx">GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-492v-c6pp-mqqv">GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-c4j6-fc7j-m34r">GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-36qx-fr4f-26g5">GHSA-36qx-fr4f-26g5: Middleware / Proxy bypass in Pages Router applications using i18n</a></li> </ul> <p><strong>Moderate:</strong></p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-ffhc-5mcf-pf4q">GHSA-ffhc-5mcf-pf4q: Cross-site scripting in App Router applications using CSP nonces</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-gx5p-jg67-6x7h">GHSA-gx5p-jg67-6x7h: Cross-site scripting in beforeInteractive scripts with untrusted input</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-h64f-5h5j-jqjh">GHSA-h64f-5h5j-jqjh: Denial of Service in the Image Optimization API</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-wfc6-r584-vfw7">GHSA-wfc6-r584-vfw7: Cache poisoning in React Server Component responses</a></li> </ul> <p><strong>Low:</strong></p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-vfv6-92ff-j949">GHSA-vfv6-92ff-j949: Cache poisoning via collisions in React Server Component cache-busting</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-3g8h-86w9-wvmq">GHSA-3g8h-86w9-wvmq: Middleware / Proxy redirects can be cache-poisoned</a></li> </ul> <h3>Core Changes</h3> <ul> <li>fix: preserve HTTP access fallbacks during prerender recovery (<a href="https://redirect.github.com/vercel/next.js/issues/92231">#92231</a>)</li> <li>Fix fallback route params case in app-page handler (<a href="https://redirect.github.com/vercel/next.js/issues/91737">#91737</a>)</li> <li>Fix invalid HTML response for route-level RSC requests in deployment adapter (<a href="https://redirect.github.com/vercel/next.js/issues/91541">#91541</a>)</li> <li>Patch setHeader for direct route handlers (<a href="https://redirect.github.com/vercel/next.js/issues/93101">#93101</a>)</li> <li>Include deployment id in <code>cacheHandlers</code> keys (<a href="https://redirect.github.com/vercel/next.js/issues/93453">#93453</a>)</li> <li>Fix double-encoding of URL pathname parts in client param parsing (<a href="https://redirect.github.com/vercel/next.js/issues/93491">#93491</a>)</li> </ul> <h2>v16.2.5</h2> <blockquote> <p>[!NOTE] This release contains security fixes and backported bug fixes. It does <strong>not</strong> include all pending features/changes on canary.</p> </blockquote> <h3>Security Fixes</h3> <p>The following advisories have been addressed:</p> <p><strong>High:</strong></p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-8h8q-6873-q5fj">GHSA-8h8q-6873-q5fj: Denial of Service with Server Components</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f">GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-mg66-mrh9-m8jx">GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-492v-c6pp-mqqv">GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-c4j6-fc7j-m34r">GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vercel/next.js/commit/ee6e79b1792a4d401ddf2480f40a83549fe8e722"><code>ee6e79b</code></a> v16.2.6</li> <li><a href="https://github.com/vercel/next.js/commit/afa053d9eb9c2a68c7eba43e84fe6bed8babcd45"><code>afa053d</code></a> Turbopack: Match proxy matchers with webpack implementation (<a href="https://redirect.github.com/vercel/next.js/issues/93594">#93594</a>)</li> <li><a href="https://github.com/vercel/next.js/commit/97a154e5bbee0cb1ac3fb8aa4db66ac36e796e3d"><code>97a154e</code></a> Turbopack: Fix middleware matcher suffix (<a href="https://redirect.github.com/vercel/next.js/issues/93590">#93590</a>)</li> <li><a href="https://github.com/vercel/next.js/commit/83899bc89103d4df1479e065c7c1e09d4698a7b6"><code>83899bc</code></a> [backport] Disable build caches for production/staging/force-preview deploys ...</li> <li><a href="https://github.com/vercel/next.js/commit/7b222b90954d607fc28a34e9b360a9b1636bc206"><code>7b222b9</code></a> [backport][test] Pin package manager to patch versions (<a href="https://redirect.github.com/vercel/next.js/issues/93595">#93595</a>)</li> <li><a href="https://github.com/vercel/next.js/commit/a8dc24f1fe23d4a22d24fac734837f7c824138f7"><code>a8dc24f</code></a> [backport] Turbopack: more strict vergen setup (<a href="https://redirect.github.com/vercel/next.js/issues/93587">#93587</a>)</li> <li><a href="https://github.com/vercel/next.js/commit/766148f9cd48c0e218acafcd0f15defc14871bf4"><code>766148f</code></a> v16.2.5</li> <li><a href="https://github.com/vercel/next.js/commit/0dd94836a8b43209fcfefa448c141683c22c1a27"><code>0dd9483</code></a> fix: add explicit checks for RSC header (<a href="https://redirect.github.com/vercel/next.js/issues/83">#83</a>) (<a href="https://redirect.github.com/vercel/next.js/issues/98">#98</a>)</li> <li><a href="https://github.com/vercel/next.js/commit/d166096c399c4fc4e09cd2d1bf26dca6579a855d"><code>d166096</code></a> fix proxy matching for segment prefetch URLs (<a href="https://redirect.github.com/vercel/next.js/issues/89">#89</a>) (<a href="https://redirect.github.com/vercel/next.js/issues/96">#96</a>)</li> <li><a href="https://github.com/vercel/next.js/commit/9d50c0b7190f59c470308578e12882788819f14c"><code>9d50c0b</code></a> Strip next-resume header from incoming requests (<a href="https://redirect.github.com/vercel/next.js/issues/92">#92</a>)</li> <li>Additional commits viewable in <a href="https://github.com/vercel/next.js/compare/v16.2.3...v16.2.6">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for next since your current version.</p> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Ben Sabic
|
ac8a20779c |
feat(chat): add chat/ai subpath for AI SDK utilities (#492)
## Summary
Introduces a dedicated `chat/ai` subpath as the home for every Vercel AI
SDK helper that ships with Chat SDK. Importing from this subpath keeps
the optional `ai` and `zod` peer dependencies out of bundles that don't
use them.
### What's new
- **`createChatTools`** — exposes Chat SDK operations as ready-to-use AI
SDK tools so an agent can read, post, react, edit, delete, and manage
thread subscriptions across every adapter the supplied `Chat` instance
has registered.
- Write operations require user approval by default (`requireApproval:
true`); toggle globally or per-tool.
- Three presets — `reader`, `messenger`, `moderator` — scope the
toolset.
- Individual tools can also be cherry-picked (`import { postMessage,
addReaction } from "chat/ai"`).
- **`toAiMessages`** (and the `Ai*` / `ToAiMessagesOptions` types) now
live alongside the tools at `chat/ai`. The previous `chat` re-exports
continue to work, but are flagged `@deprecated` with an editor hint
pointing to the new home — migration is a one-line import change.
- **Docs** — new `/docs/ai` section between Usage and Adapters in the
sidebar:
- `/docs/ai` — Overview
- `/docs/ai/ai-sdk-tools` — `createChatTools` guide
- `/docs/ai/to-ai-messages` — `toAiMessages` reference
- `/docs/ai/types` — Reference for every type exported from `chat/ai`
- **Example app** — `examples/nextjs-chat` now demos the new surface via
a "Run Agent Demo" button on the welcome card and a free-form `/agent
<prompt>` slash command (streaming, with a placeholder so users get
immediate feedback in channel contexts where Slack's typing-status API
is a no-op).
### Future plans
`createChatTools` currently exposes the cross-adapter Chat SDK surface
only. A natural follow-up is to also support **platform-specific tools**
— e.g. expose Slack-only `pin`/`unpin`, Discord-only thread archiving,
GitHub-only issue commenting, etc., so users can further extend what
their agent can do without dropping back to raw adapter calls. The shape
would likely be additional opt-in factories under `chat/ai` (or
per-adapter subpaths like `@chat-adapter/slack/ai`) that return tools
layered on top of the platform-specific adapter clients, while keeping
the cross-platform `createChatTools` API as the lowest common
denominator.
### Coverage
- `createChatTools` orchestrator: 100% statements / 94.7% branches.
- Every tool factory's `execute()` is exercised end-to-end (29 tests in
`index.test.ts`).
- `toAiMessages` keeps its existing 35-test suite covering role mapping,
attachment handling, links, transforms, and unsupported-attachment
fallbacks.
- Tools folder overall: 99.0% statements / 86.1% branches / 97.4%
functions / 98.9% lines.
---------
Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>
Co-authored-by: dancer <josh@afterima.ge>
|
||
|
josh
|
b75eedbb5f |
feat(chat): add queue-debounce concurrency strategy (#495)
## summary adds an opt-in `burst` concurrency strategy for #414 when a thread is idle, the first message waits for `debounceMs`, messages that arrive during that window are queued, and the handler runs once with the latest message plus earlier burst messages in `context.skipped` after the handler finishes, messages that arrived while it was running are drained like `queue`, so the latest queued message is processed with earlier queued messages in `context.skipped` keeps existing `drop`, `queue`, `debounce`, and `concurrent` behavior unchanged updates docs to cover `burst`, explain when to choose it over `debounce`, and document the related `MessageContext` behavior |
||
|
Hugo
|
716e934aa2 |
feat(web-adapter): first class support for Vue and Svelte (#498)
## Summary <!-- What does this PR do? --> ## Test plan <!-- How did you verify the changes? --> ## Checklist - [ ] All commits are signed and verified - [ ] `pnpm validate` passes - [ ] Changeset added (or N/A — see [CONTRIBUTING.md](./CONTRIBUTING.md)) - [ ] Documentation updated (or N/A) --------- Co-authored-by: dancer <josh@afterima.ge> |
||
|
Ben Sabic
|
2f108bd4b3 |
feat: rename adapter.client to adapter.octokit / adapter.linearClient / adapter.webClient (#478)
## Summary
Rename the public native client getter on the GitHub, Linear, and Slack
adapters so it matches the underlying SDK class instead of the generic
`.client`. The previous `.client` getter is preserved as a `@deprecated`
alias on all three adapters, so existing code keeps working without
changes.
- `bot.getAdapter("github").client` is now
`bot.getAdapter("github").octokit` (returns `Octokit`)
- `bot.getAdapter("linear").client` is now
`bot.getAdapter("linear").linearClient` (returns `LinearClient` from
`@linear/sdk`)
- `bot.getAdapter("slack").client` is now
`bot.getAdapter("slack").webClient` (returns `WebClient` from
`@slack/web-api`)
Each new getter has TSDoc covering single- vs multi-tenant resolution
rules and when calling outside a webhook handler throws. Focused unit
tests assert that the new getter returns the underlying SDK instance,
that single-tenant calls return the same instance, that the deprecated
`.client` alias points at the new getter, that multi-tenant mode without
webhook context throws on both getters, and that inside a webhook
context the getter resolves to the per-tenant client.
Commits are split for review:
1. `feat(adapter-github): rename adapter.client to adapter.octokit`
2. `feat(adapter-linear): rename adapter.client to adapter.linearClient`
3. `docs: use .octokit / .linearClient in chat-sdk.dev examples`
4. `chore: changeset for adapter native client getter rename`
5. `fix: hoist regex literals in new client-getter tests to module
scope`
6. `feat(adapter-slack): rename adapter.client to adapter.webClient`
7. `docs: include slack .webClient in chat-sdk.dev examples`
8. `chore: include adapter-slack in native client getter rename
changeset`
9. `test(adapter-github,adapter-linear): cover with-context resolution
on the new client getters`
---------
Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>
|
||
|
Ben Sabic
|
cd7b6af1c8 |
test(integration-tests): add Emulate.dev-backed tests for the GitHub adapter (#479)
## Summary Add an Emulate.dev-backed integration-test suite for the GitHub adapter, mirroring the structure of the Slack work in #477. Tests drive the adapter against an in-process [`@emulators/github`](https://emulate.dev/docs/github) server and assert on its stateful store (comments, reviews) rather than `mock.calls`, catching wire-format and contract issues that pure Octokit mocks miss. - New private devDeps in `packages/integration-tests`: `@emulators/github`, `@emulators/core`, `@hono/node-server`, plus a workspace dep on `@chat-adapter/github`. (`@emulators/core` and `@hono/node-server` are also declared by #477; this PR is independent of merge order.) - New harness `packages/integration-tests/src/github-emulator-utils.ts` boots the emulator on an ephemeral `127.0.0.1` port, seeds a deterministic user / repo / issue / PR / starter review comment, and exposes a near-passthrough HTTP forwarder. **No re-signing needed** here. `@emulators/core`'s `WebhookDispatcher` already signs deliveries with `X-Hub-Signature-256: sha256=<hex>` exactly as the GitHub adapter expects. The harness also adds a small URL rewriter for Octokit's `pulls.createReplyForReviewComment` shortcut endpoint, translating it into the canonical review-comment POST that the emulator implements. - Four new test files (12 tests), wired to the adapter via its existing `apiUrl` + `webhookSecret` config **zero source changes** to `packages/adapter-github`: - `emulator-github-auth.test.ts` (2) `GET /user` populates `botUserId` during `initialize()`. - `emulator-github-comments.test.ts` (4) `thread.post` / `edit` / `delete` on issue and PR-conversation threads. - `emulator-github-reviews.test.ts` (3) review-comment replies routed through `pulls.createReplyForReviewComment` with the right \`in_reply_to_id\`, plus edit / delete. - `emulator-github-events.test.ts` (3) full inbound `issue_comment` / `pull_request_review_comment` round-trip, including bot self-message filtering. ```mermaid flowchart LR subgraph Test["Vitest test process"] SDK[GitHubAdapter + Chat] Forwarder["HTTP forwarder<br/>passthrough"] Emu["@emulators/github<br/>(in-process Hono)"] end SDK -->|"issues.createComment / pulls.* / GET /user<br/>(apiUrl override)"| Emu Emu -->|"X-Hub-Signature-256 + x-github-event"| Forwarder Forwarder -->|"chat.webhooks.github(request)"| SDK ``` ### Out of scope (deliberate) - **Reactions** `@emulators/github` does not implement the `/reactions` endpoints used by the adapter. Reaction logic is still covered by the existing mock-based tests in `packages/adapter-github/src/index.test.ts`. - **GitHub App auth** (JWT \u2192 installation token via `POST /app/installations/:id/access_tokens`) the adapter and emulator both support it, but PAT-mode was the agreed scope here. - **Multi-tenant install flows** via `installation` webhook events. - Branches/refs, releases, search, actions, checks not used by the adapter. ## Test plan - [x] `pnpm --filter @chat-adapter/integration-tests test` 407 tests pass across 34 files (including the 12 new emulator-github tests, ~480 ms total). - [x] `pnpm check` and `pnpm knip` clean. - [x] CI safety verified: ephemeral ports (`port: 0`), loopback-only binds (`127.0.0.1`), deterministic teardown via `httpServer.close()`, no env vars, no external network egress. ## Checklist - [x] All commits are signed and verified - [x] \`pnpm validate\` passes - [x] Changeset added (or N/A see [CONTRIBUTING.md](./CONTRIBUTING.md)) N/A: \`@chat-adapter/integration-tests\` is \`private: true\` and the change is test-only. - [x] Documentation updated (or N/A) \`packages/integration-tests/README.md\` describes the new emulator-github test category. --------- Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com> |
||
|
Malte Ubl
|
c889e040e7 | defense-in-depth against release.yml running at the wrong time (#494) | ||
|
Ben Sabic
|
79227ae991 |
docs: refresh adapter pages with hand-authored MDX (#474)
## Summary
Refreshes the adapter docs end-to-end so every adapter — official,
vendor-official, and community — now ships hand-authored MDX, lives
under a clean URL structure, and renders on a polished
sidebar/right-rail layout dedicated to `/adapters` (the shared `/docs`
chrome is untouched).
```mermaid
flowchart LR
subgraph Before
direction TB
OB[official] --> CB[community<br/>incl. 5 vendor pages]
end
subgraph After
direction TB
OA[official] --> VA[vendor-official<br/>5 pages] --> CA[community]
end
Before -.-> After
```
### Content & routing
- **New `/adapters/vendor-official/<slug>` route** for vendor-maintained
adapters (Beeper Matrix, Photon iMessage, Liveblocks, Resend, Zernio).
Sidebar gets a third labelled group ("Vendor-Official Adapters") between
Official and Community, with a top divider matching the existing
Community treatment.
- **All 13 vendor-official + community adapters migrated** from runtime
README fetching to hand-authored MDX with rich `features:` matrices and
full body content (install, quick start, configuration, auth,
gateway/streaming, troubleshooting). README fetch stays as a fallback
for any future community adapter that hasn't been migrated yet, gated by
a new `mdxBody: true` frontmatter flag.
- **Messenger filter pages removed** (`/adapters/for/<messenger>` + the
"Browse by messenger" chip row on `/adapters`). Existing URLs
308-redirect to `/adapters`.
- **Permanent redirects** from
`/adapters/community/{matrix,imessage,resend,zernio,liveblocks}` to
their new `/adapters/vendor-official/...` paths.
- **Fixed** `/docs/adapters` and `/docs/state` so the bare pages are
accessible again — the previous catch-all redirect (`:slug*`) was
swallowing them. Switched to `:slug+` so subpath URLs still 308 while
the bare pages render.
### Visual polish
- **Adapter-only sidebar variant** (`AdaptersDocsLayout` +
`AdaptersSidebar`) with uppercase eyebrow separators, tighter rows, and
a thin themed scrollbar utility class. The shared `/docs` sidebar is
untouched.
- **Restyled `AdapterHero`**: drops the badges row + packageName, sits
the title inline with the logo, larger 17 px tagline, horizontal divider
beneath the block.
- **Restyled `PackageInstall`** as a tabbed dark single-line snippet
with a `$` prompt prefix and a copy button — replaces the previous
multi-line `CodeBlock` layout.
- **New "Deploy your chat app on Vercel" upsell card** (`<Upsell />`)
replaces the old `EditSource / ScrollTop / Feedback / CopyPage` footer
cluster on every adapter detail page.
- **Listing & messenger pages**: align the H1 to a tighter `text-4xl
sm:text-[44px]`, and the section headers to `text-base font-medium
tracking-tight` with a one-line muted lede.
### Tooling & tests
- Added `mdxBody: true` opt-in to the adapter frontmatter schema
(`source.config.ts`), and updated both detail-page handlers
(`community/[slug]` and the new `vendor-official/[slug]`) to render the
MDX body when present, falling back to README fetch otherwise.
- Refactored both detail-page handlers to flatten the body-render
branches into a `renderBody()` helper, removing the nested ternaries
that were tripping `lint/style/noNestedTernary`.
- New test file
[`packages/integration-tests/src/docs-adapters.test.ts`](https://github.com/vercel/chat/blob/docs/refresh-adapters/packages/integration-tests/src/docs-adapters.test.ts)
— **220 new assertions** covering:
- Adapter MDX frontmatter completeness, slug ↔ filename consistency, and
`type ∈ {platform, state}`.
- Vendor-official invariants: exactly the expected slugs,
`vendorOfficial: true`, `community: true`, `author`, `mdxBody: true`,
`<FeatureSupport />` rendered.
- Community invariants: `community: true` (never vendor-official),
`mdxBody: true`, `<FeatureSupport />`.
- Official invariants: never flagged, `packageName` always under
`@chat-adapter/*`.
- `adapters.json` ↔ MDX sync on `packageName` / `type` / `community` /
`vendorOfficial`.
- Extended `VALID_DOC_PACKAGES` so `docs-content.test.ts` accepts the
new vendor-official + community packages, plus `@chat-adapter/web`,
`@chat-adapter/web/react`, and `@chat-adapter/messenger`.
### Per-package AGENTS.md
- Added `AGENTS.md` to every official adapter and state adapter (14
packages), each tailored to that adapter's surface — overview, directory
layout, build/test commands, public exports, thread ID format, webhook
flow, authentication, format conversion, cards/streaming, platform
quirks, testing approach, coding conventions, and release rules.
- Added a one-line `CLAUDE.md` (`@AGENTS.md`) beside each so Claude Code
picks up the same instructions through its built-in resolver — same
convention as the root.
### Web adapter copy
- Cleaned up the Web adapter tagline (removed inline backticks) and
dropped the now-redundant "v1 scope" section from the body.
---------
Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>
|
||
|
josh
|
b9b17cd37d |
fix(discord): handle interactions in gateway-only mode (#490)
## summary fixes #343 fix Discord gateway-only mode so `InteractionCreate` events are handled directly when no interactions endpoint is configured slash commands now defer the gateway interaction and route through the existing slash command handler path, and button interactions defer updates before routing through the existing action handler path also clarifies in the Discord README that Discord sends interactions through either the Gateway or an Interactions Endpoint URL, not both |
||
|
josh
|
67c1794a54 |
docs(chat): clarify direct message routing precedence (#491)
## summary clarifies that registered `onDirectMessage` handlers take precedence for incoming DM messages before subscribed-message, mention, and pattern routing updates the direct messages, event handling, thread subscription, and API docs so they match the current runtime behavior adds `onDirectMessage` to the Chat API docs fixes #432 |