648 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
github-actions[bot]	6581d31507	chore(release): version packages (#469) ... This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated. # Releases ## @chat-adapter/discord@4.29.0 ### Minor Changes - 2ffed48: Adapter internals are now `protected` rather than `private`, so consumers can subclass an adapter to override or extend its behavior (e.g. handling additional Telegram update types by overriding `processUpdate`). ### Patch Changes - e60bc8c: chore: set supported Node versions in engines - b9b17cd: handle slash commands and button interactions in Discord gateway-only mode - Updated dependencies [ac8a207] - Updated dependencies [e60bc8c] - Updated dependencies [add2730] - Updated dependencies [b75eedb] - chat@4.29.0 - @chat-adapter/shared@4.29.0 ## @chat-adapter/gchat@4.29.0 ### Minor Changes - 2ffed48: Adapter internals are now `protected` rather than `private`, so consumers can subclass an adapter to override or extend its behavior (e.g. handling additional Telegram update types by overriding `processUpdate`). ### Patch Changes - e60bc8c: chore: set supported Node versions in engines - 06fb8e5: Align package shapes with the new `konsistent` conventions. All changes are backwards-compatible — previous type names are kept as deprecated aliases. - `@chat-adapter/gchat`, `@chat-adapter/slack`: moved `*AdapterConfig` (and related sub-types) into a `./types` module; the public re-exports from `index.ts` are unchanged. - `@chat-adapter/slack`: `createSlackAdapter` now accepts `SlackAdapterConfig` directly instead of `Partial<SlackAdapterConfig>`. Every field on the config was already optional, so no call sites need to change. - `@chat-adapter/messenger`: `MessengerAdapterConfig` fields are now optional (the factory still falls back to `FACEBOOK_*` env vars), and `logger` / `userName` live on `MessengerAdapterConfig` directly. The factory signature is now `createMessengerAdapter(config?: MessengerAdapterConfig)`. - `@chat-adapter/web`: renamed `WebAdapterOptions` to `WebAdapterConfig`; the old name is exported as a deprecated alias. - `@chat-adapter/whatsapp`: every field on `WhatsAppAdapterConfig` is optional (the factory still falls back to `WHATSAPP_*` env vars). `createWhatsAppAdapter` is now typed `(config?: WhatsAppAdapterConfig) => WhatsAppAdapter`. - `@chat-adapter/state-memory`: added an empty `MemoryStateAdapterOptions` type so the package matches every other state adapter; `createMemoryState` now accepts an optional argument of that type. - `@chat-adapter/state-ioredis`, `@chat-adapter/state-redis`, `@chat-adapter/state-pg`: the URL- and client-based option shapes were split into named interfaces (`*StateAdapterUrlOptions` / `*StateAdapterClientOptions`) and unified under `*StateAdapterOptions`. The factories now take the union type directly. Old names — `RedisStateClientOptions`, `CreateRedisStateOptions`, `PostgresStateClientOptions`, `CreatePostgresStateOptions`, `IoRedisStateClientOptions` — are kept as deprecated aliases. - Updated dependencies [ac8a207] - Updated dependencies [e60bc8c] - Updated dependencies [add2730] - Updated dependencies [b75eedb] - chat@4.29.0 - @chat-adapter/shared@4.29.0 ## @chat-adapter/github@4.29.0 ### Minor Changes - 2f108bd: Rename the typed native client getter on the Slack, GitHub, and Linear adapters to match the underlying SDK class. - `bot.getAdapter("slack").client` is now `bot.getAdapter("slack").webClient` (returns `WebClient` from `@slack/web-api`). - `bot.getAdapter("github").client` is now `bot.getAdapter("github").octokit` (returns `Octokit`). - `bot.getAdapter("linear").client` is now `bot.getAdapter("linear").linearClient` (returns `LinearClient`). The previous `.client` getter is kept as a deprecated alias on all three adapters, so existing code continues to work without changes. - 2ffed48: Adapter internals are now `protected` rather than `private`, so consumers can subclass an adapter to override or extend its behavior (e.g. handling additional Telegram update types by overriding `processUpdate`). ### Patch Changes - e60bc8c: chore: set supported Node versions in engines - Updated dependencies [ac8a207] - Updated dependencies [e60bc8c] - Updated dependencies [add2730] - Updated dependencies [b75eedb] - chat@4.29.0 - @chat-adapter/shared@4.29.0 ## @chat-adapter/linear@4.29.0 ### Minor Changes - 2f108bd: Rename the typed native client getter on the Slack, GitHub, and Linear adapters to match the underlying SDK class. - `bot.getAdapter("slack").client` is now `bot.getAdapter("slack").webClient` (returns `WebClient` from `@slack/web-api`). - `bot.getAdapter("github").client` is now `bot.getAdapter("github").octokit` (returns `Octokit`). - `bot.getAdapter("linear").client` is now `bot.getAdapter("linear").linearClient` (returns `LinearClient`). The previous `.client` getter is kept as a deprecated alias on all three adapters, so existing code continues to work without changes. - 2ffed48: Adapter internals are now `protected` rather than `private`, so consumers can subclass an adapter to override or extend its behavior (e.g. handling additional Telegram update types by overriding `processUpdate`). ### Patch Changes - e60bc8c: chore: set supported Node versions in engines - Updated dependencies [ac8a207] - Updated dependencies [e60bc8c] - Updated dependencies [add2730] - Updated dependencies [b75eedb] - chat@4.29.0 - @chat-adapter/shared@4.29.0 ## @chat-adapter/messenger@4.29.0 ### Minor Changes - 2ffed48: Adapter internals are now `protected` rather than `private`, so consumers can subclass an adapter to override or extend its behavior (e.g. handling additional Telegram update types by overriding `processUpdate`). ### Patch Changes - e60bc8c: chore: set supported Node versions in engines - 06fb8e5: Align package shapes with the new `konsistent` conventions. All changes are backwards-compatible — previous type names are kept as deprecated aliases. - `@chat-adapter/gchat`, `@chat-adapter/slack`: moved `*AdapterConfig` (and related sub-types) into a `./types` module; the public re-exports from `index.ts` are unchanged. - `@chat-adapter/slack`: `createSlackAdapter` now accepts `SlackAdapterConfig` directly instead of `Partial<SlackAdapterConfig>`. Every field on the config was already optional, so no call sites need to change. - `@chat-adapter/messenger`: `MessengerAdapterConfig` fields are now optional (the factory still falls back to `FACEBOOK_*` env vars), and `logger` / `userName` live on `MessengerAdapterConfig` directly. The factory signature is now `createMessengerAdapter(config?: MessengerAdapterConfig)`. - `@chat-adapter/web`: renamed `WebAdapterOptions` to `WebAdapterConfig`; the old name is exported as a deprecated alias. - `@chat-adapter/whatsapp`: every field on `WhatsAppAdapterConfig` is optional (the factory still falls back to `WHATSAPP_*` env vars). `createWhatsAppAdapter` is now typed `(config?: WhatsAppAdapterConfig) => WhatsAppAdapter`. - `@chat-adapter/state-memory`: added an empty `MemoryStateAdapterOptions` type so the package matches every other state adapter; `createMemoryState` now accepts an optional argument of that type. - `@chat-adapter/state-ioredis`, `@chat-adapter/state-redis`, `@chat-adapter/state-pg`: the URL- and client-based option shapes were split into named interfaces (`*StateAdapterUrlOptions` / `*StateAdapterClientOptions`) and unified under `*StateAdapterOptions`. The factories now take the union type directly. Old names — `RedisStateClientOptions`, `CreateRedisStateOptions`, `PostgresStateClientOptions`, `CreatePostgresStateOptions`, `IoRedisStateClientOptions` — are kept as deprecated aliases. - Updated dependencies [ac8a207] - Updated dependencies [e60bc8c] - Updated dependencies [add2730] - Updated dependencies [b75eedb] - chat@4.29.0 - @chat-adapter/shared@4.29.0 ## @chat-adapter/shared@4.29.0 ### Minor Changes - add2730: support typed Telegram attachment uploads ### Patch Changes - e60bc8c: chore: set supported Node versions in engines - Updated dependencies [ac8a207] - Updated dependencies [e60bc8c] - Updated dependencies [b75eedb] - chat@4.29.0 ## @chat-adapter/slack@4.29.0 ### Minor Changes - 2f108bd: Rename the typed native client getter on the Slack, GitHub, and Linear adapters to match the underlying SDK class. - `bot.getAdapter("slack").client` is now `bot.getAdapter("slack").webClient` (returns `WebClient` from `@slack/web-api`). - `bot.getAdapter("github").client` is now `bot.getAdapter("github").octokit` (returns `Octokit`). - `bot.getAdapter("linear").client` is now `bot.getAdapter("linear").linearClient` (returns `LinearClient`). The previous `.client` getter is kept as a deprecated alias on all three adapters, so existing code continues to work without changes. - c46fdb6: Add support for external `installationProvider` and Enterprise Grid org-wide installs. - New optional `installationProvider` config: `{ getInstallation(installationId, isEnterpriseInstall) => Promise<SlackInstallation | null> }`. When set, the adapter resolves bot tokens for incoming events, slash commands, and interactive payloads through the provider instead of the internal `StateAdapter` — useful for hosted token-management systems (e.g. Vercel Connect). The provider is read-only; OAuth callback writes (`setInstallation`, `handleOAuthCallback`) and the `getInstallation`/`deleteInstallation` public methods continue to use internal state, so callers using a provider should manage their own writes. - Enterprise Grid org-wide installs (`is_enterprise_install: true`) are now keyed on `enterprise_id` instead of `team_id` across event_callback, slash command, and interactive payload paths. Multi-workspace deployments using the internal `StateAdapter` for org-wide installs must repopulate installations under the `enterprise_id` key — previously, org-wide events would fall through to a `team_id` lookup that did not match what the OAuth flow had stored. - fdebde7: feat(slack): expose direct `WebClient` access via `adapter.client` `bot.getAdapter("slack").client` now returns a typed `WebClient` from `@slack/web-api`, matching the existing pattern on the Linear and GitHub adapters. The returned client is bound to the bot token for the current request context (multi-workspace) or the configured default token (single-workspace). Use it for any Web API call not covered by the SDK's high-level methods, e.g. `adapter.client.pins.add(...)` or `adapter.client.usergroups.list(...)`. Resolution order: 1. The token from the current `requestContext` — set during webhook handling, or by `adapter.withBotToken(token, fn)`. 2. The default `botToken`, when configured as a static string or a synchronous resolver function. Throws `AuthenticationError` outside of any context in multi-workspace mode, or when `botToken` is configured as an async resolver function. For async tokens, await the token first and bind it explicitly with `adapter.withBotToken(token, () => adapter.client...)`. Also fixes `createSlackAdapter()` silently dropping the `apiUrl` config field. - 2ffed48: Adapter internals are now `protected` rather than `private`, so consumers can subclass an adapter to override or extend its behavior (e.g. handling additional Telegram update types by overriding `processUpdate`). ### Patch Changes - e60bc8c: chore: set supported Node versions in engines - 06fb8e5: Align package shapes with the new `konsistent` conventions. All changes are backwards-compatible — previous type names are kept as deprecated aliases. - `@chat-adapter/gchat`, `@chat-adapter/slack`: moved `*AdapterConfig` (and related sub-types) into a `./types` module; the public re-exports from `index.ts` are unchanged. - `@chat-adapter/slack`: `createSlackAdapter` now accepts `SlackAdapterConfig` directly instead of `Partial<SlackAdapterConfig>`. Every field on the config was already optional, so no call sites need to change. - `@chat-adapter/messenger`: `MessengerAdapterConfig` fields are now optional (the factory still falls back to `FACEBOOK_*` env vars), and `logger` / `userName` live on `MessengerAdapterConfig` directly. The factory signature is now `createMessengerAdapter(config?: MessengerAdapterConfig)`. - `@chat-adapter/web`: renamed `WebAdapterOptions` to `WebAdapterConfig`; the old name is exported as a deprecated alias. - `@chat-adapter/whatsapp`: every field on `WhatsAppAdapterConfig` is optional (the factory still falls back to `WHATSAPP_*` env vars). `createWhatsAppAdapter` is now typed `(config?: WhatsAppAdapterConfig) => WhatsAppAdapter`. - `@chat-adapter/state-memory`: added an empty `MemoryStateAdapterOptions` type so the package matches every other state adapter; `createMemoryState` now accepts an optional argument of that type. - `@chat-adapter/state-ioredis`, `@chat-adapter/state-redis`, `@chat-adapter/state-pg`: the URL- and client-based option shapes were split into named interfaces (`*StateAdapterUrlOptions` / `*StateAdapterClientOptions`) and unified under `*StateAdapterOptions`. The factories now take the union type directly. Old names — `RedisStateClientOptions`, `CreateRedisStateOptions`, `PostgresStateClientOptions`, `CreatePostgresStateOptions`, `IoRedisStateClientOptions` — are kept as deprecated aliases. - 0f0c203: fix(slack): prefer `webhookVerifier` over `signingSecret` and `SLACK_SIGNING_SECRET` When a `webhookVerifier` is configured, it now takes precedence over both the `signingSecret` config field and the `SLACK_SIGNING_SECRET` env var. Previously, a configured `signingSecret` (or env var) would shadow the verifier. - Updated dependencies [ac8a207] - Updated dependencies [e60bc8c] - Updated dependencies [add2730] - Updated dependencies [b75eedb] - chat@4.29.0 - @chat-adapter/shared@4.29.0 ## @chat-adapter/teams@4.29.0 ### Minor Changes - 2ffed48: Adapter internals are now `protected` rather than `private`, so consumers can subclass an adapter to override or extend its behavior (e.g. handling additional Telegram update types by overriding `processUpdate`). ### Patch Changes - e60bc8c: chore: set supported Node versions in engines - Updated dependencies [ac8a207] - Updated dependencies [e60bc8c] - Updated dependencies [add2730] - Updated dependencies [b75eedb] - chat@4.29.0 - @chat-adapter/shared@4.29.0 ## @chat-adapter/telegram@4.29.0 ### Minor Changes - add2730: support typed Telegram attachment uploads - 2ffed48: Adapter internals are now `protected` rather than `private`, so consumers can subclass an adapter to override or extend its behavior (e.g. handling additional Telegram update types by overriding `processUpdate`). ### Patch Changes - e60bc8c: chore: set supported Node versions in engines - 711babe: Handle `video_note` (round video messages) in `extractAttachments`. Previously these messages were silently dropped; now they are returned as `video` attachments with `width`/`height` set to the clip's `length`. - Updated dependencies [ac8a207] - Updated dependencies [e60bc8c] - Updated dependencies [add2730] - Updated dependencies [b75eedb] - chat@4.29.0 - @chat-adapter/shared@4.29.0 ## @chat-adapter/web@4.29.0 ### Minor Changes - 2ffed48: Adapter internals are now `protected` rather than `private`, so consumers can subclass an adapter to override or extend its behavior (e.g. handling additional Telegram update types by overriding `processUpdate`). - 716e934: Add first-class Vue and Svelte support via new subpath exports `@chat-adapter/web/vue` and `@chat-adapter/web/svelte`. Each exports a `useChat()` factory preconfigured with `DefaultChatTransport`, returning a framework-reactive `Chat` instance from `@ai-sdk/vue` / `@ai-sdk/svelte` respectively. Note: unlike the React subpath which wraps `@ai-sdk/react`'s `useChat` hook and returns destructurable helpers, the Vue and Svelte wrappers return a `Chat` class instance — access `chat.messages`, `chat.sendMessage()`, `chat.status`, and `chat.stop()` directly on the object. ### Patch Changes - e60bc8c: chore: set supported Node versions in engines - 06fb8e5: Align package shapes with the new `konsistent` conventions. All changes are backwards-compatible — previous type names are kept as deprecated aliases. - `@chat-adapter/gchat`, `@chat-adapter/slack`: moved `*AdapterConfig` (and related sub-types) into a `./types` module; the public re-exports from `index.ts` are unchanged. - `@chat-adapter/slack`: `createSlackAdapter` now accepts `SlackAdapterConfig` directly instead of `Partial<SlackAdapterConfig>`. Every field on the config was already optional, so no call sites need to change. - `@chat-adapter/messenger`: `MessengerAdapterConfig` fields are now optional (the factory still falls back to `FACEBOOK_*` env vars), and `logger` / `userName` live on `MessengerAdapterConfig` directly. The factory signature is now `createMessengerAdapter(config?: MessengerAdapterConfig)`. - `@chat-adapter/web`: renamed `WebAdapterOptions` to `WebAdapterConfig`; the old name is exported as a deprecated alias. - `@chat-adapter/whatsapp`: every field on `WhatsAppAdapterConfig` is optional (the factory still falls back to `WHATSAPP_*` env vars). `createWhatsAppAdapter` is now typed `(config?: WhatsAppAdapterConfig) => WhatsAppAdapter`. - `@chat-adapter/state-memory`: added an empty `MemoryStateAdapterOptions` type so the package matches every other state adapter; `createMemoryState` now accepts an optional argument of that type. - `@chat-adapter/state-ioredis`, `@chat-adapter/state-redis`, `@chat-adapter/state-pg`: the URL- and client-based option shapes were split into named interfaces (`*StateAdapterUrlOptions` / `*StateAdapterClientOptions`) and unified under `*StateAdapterOptions`. The factories now take the union type directly. Old names — `RedisStateClientOptions`, `CreateRedisStateOptions`, `PostgresStateClientOptions`, `CreatePostgresStateOptions`, `IoRedisStateClientOptions` — are kept as deprecated aliases. - Updated dependencies [ac8a207] - Updated dependencies [e60bc8c] - Updated dependencies [add2730] - Updated dependencies [b75eedb] - chat@4.29.0 - @chat-adapter/shared@4.29.0 ## @chat-adapter/whatsapp@4.29.0 ### Minor Changes - 2ffed48: Adapter internals are now `protected` rather than `private`, so consumers can subclass an adapter to override or extend its behavior (e.g. handling additional Telegram update types by overriding `processUpdate`). ### Patch Changes - e60bc8c: chore: set supported Node versions in engines - 06fb8e5: Align package shapes with the new `konsistent` conventions. All changes are backwards-compatible — previous type names are kept as deprecated aliases. - `@chat-adapter/gchat`, `@chat-adapter/slack`: moved `*AdapterConfig` (and related sub-types) into a `./types` module; the public re-exports from `index.ts` are unchanged. - `@chat-adapter/slack`: `createSlackAdapter` now accepts `SlackAdapterConfig` directly instead of `Partial<SlackAdapterConfig>`. Every field on the config was already optional, so no call sites need to change. - `@chat-adapter/messenger`: `MessengerAdapterConfig` fields are now optional (the factory still falls back to `FACEBOOK_*` env vars), and `logger` / `userName` live on `MessengerAdapterConfig` directly. The factory signature is now `createMessengerAdapter(config?: MessengerAdapterConfig)`. - `@chat-adapter/web`: renamed `WebAdapterOptions` to `WebAdapterConfig`; the old name is exported as a deprecated alias. - `@chat-adapter/whatsapp`: every field on `WhatsAppAdapterConfig` is optional (the factory still falls back to `WHATSAPP_*` env vars). `createWhatsAppAdapter` is now typed `(config?: WhatsAppAdapterConfig) => WhatsAppAdapter`. - `@chat-adapter/state-memory`: added an empty `MemoryStateAdapterOptions` type so the package matches every other state adapter; `createMemoryState` now accepts an optional argument of that type. - `@chat-adapter/state-ioredis`, `@chat-adapter/state-redis`, `@chat-adapter/state-pg`: the URL- and client-based option shapes were split into named interfaces (`*StateAdapterUrlOptions` / `*StateAdapterClientOptions`) and unified under `*StateAdapterOptions`. The factories now take the union type directly. Old names — `RedisStateClientOptions`, `CreateRedisStateOptions`, `PostgresStateClientOptions`, `CreatePostgresStateOptions`, `IoRedisStateClientOptions` — are kept as deprecated aliases. - Updated dependencies [ac8a207] - Updated dependencies [e60bc8c] - Updated dependencies [add2730] - Updated dependencies [b75eedb] - chat@4.29.0 - @chat-adapter/shared@4.29.0 ## chat@4.29.0 ### Minor Changes - ac8a207: Add `chat/ai` subpath as the home for AI utilities, including `createChatTools` for the Vercel AI SDK and `toAiMessages` for converting chat history into AI SDK prompts. `createChatTools` exposes Chat SDK operations as ready-to-use AI SDK tools so an agent can read messages, post replies, send DMs, react, edit, delete, and manage thread subscriptions across every adapter the supplied `Chat` instance has registered. Write operations require user approval by default and can be toggled globally or per-tool via `requireApproval`. Three presets (`reader`, `messenger`, `moderator`) scope the toolset, and tools can also be cherry-picked from the same subpath. `toAiMessages` (and the `AiMessage` / `AiMessagePart` / `ToAiMessagesOptions` types) now ship from `chat/ai` alongside the tools — keeping the optional `ai` and `zod` peer dependencies out of bundles that don't use them. The previous `chat` re-exports continue to work, but are marked `@deprecated` so editors surface a hint pointing at `chat/ai`; existing code keeps compiling, and migrating is a single import-path change. - b75eedb: add burst concurrency strategy ### Patch Changes - e60bc8c: chore: set supported Node versions in engines ## @chat-adapter/state-ioredis@4.29.0 ### Patch Changes - e60bc8c: chore: set supported Node versions in engines - 06fb8e5: Align package shapes with the new `konsistent` conventions. All changes are backwards-compatible — previous type names are kept as deprecated aliases. - `@chat-adapter/gchat`, `@chat-adapter/slack`: moved `*AdapterConfig` (and related sub-types) into a `./types` module; the public re-exports from `index.ts` are unchanged. - `@chat-adapter/slack`: `createSlackAdapter` now accepts `SlackAdapterConfig` directly instead of `Partial<SlackAdapterConfig>`. Every field on the config was already optional, so no call sites need to change. - `@chat-adapter/messenger`: `MessengerAdapterConfig` fields are now optional (the factory still falls back to `FACEBOOK_*` env vars), and `logger` / `userName` live on `MessengerAdapterConfig` directly. The factory signature is now `createMessengerAdapter(config?: MessengerAdapterConfig)`. - `@chat-adapter/web`: renamed `WebAdapterOptions` to `WebAdapterConfig`; the old name is exported as a deprecated alias. - `@chat-adapter/whatsapp`: every field on `WhatsAppAdapterConfig` is optional (the factory still falls back to `WHATSAPP_*` env vars). `createWhatsAppAdapter` is now typed `(config?: WhatsAppAdapterConfig) => WhatsAppAdapter`. - `@chat-adapter/state-memory`: added an empty `MemoryStateAdapterOptions` type so the package matches every other state adapter; `createMemoryState` now accepts an optional argument of that type. - `@chat-adapter/state-ioredis`, `@chat-adapter/state-redis`, `@chat-adapter/state-pg`: the URL- and client-based option shapes were split into named interfaces (`*StateAdapterUrlOptions` / `*StateAdapterClientOptions`) and unified under `*StateAdapterOptions`. The factories now take the union type directly. Old names — `RedisStateClientOptions`, `CreateRedisStateOptions`, `PostgresStateClientOptions`, `CreatePostgresStateOptions`, `IoRedisStateClientOptions` — are kept as deprecated aliases. - Updated dependencies [ac8a207] - Updated dependencies [e60bc8c] - Updated dependencies [b75eedb] - chat@4.29.0 ## @chat-adapter/state-memory@4.29.0 ### Patch Changes - e60bc8c: chore: set supported Node versions in engines - 06fb8e5: Align package shapes with the new `konsistent` conventions. All changes are backwards-compatible — previous type names are kept as deprecated aliases. - `@chat-adapter/gchat`, `@chat-adapter/slack`: moved `*AdapterConfig` (and related sub-types) into a `./types` module; the public re-exports from `index.ts` are unchanged. - `@chat-adapter/slack`: `createSlackAdapter` now accepts `SlackAdapterConfig` directly instead of `Partial<SlackAdapterConfig>`. Every field on the config was already optional, so no call sites need to change. - `@chat-adapter/messenger`: `MessengerAdapterConfig` fields are now optional (the factory still falls back to `FACEBOOK_*` env vars), and `logger` / `userName` live on `MessengerAdapterConfig` directly. The factory signature is now `createMessengerAdapter(config?: MessengerAdapterConfig)`. - `@chat-adapter/web`: renamed `WebAdapterOptions` to `WebAdapterConfig`; the old name is exported as a deprecated alias. - `@chat-adapter/whatsapp`: every field on `WhatsAppAdapterConfig` is optional (the factory still falls back to `WHATSAPP_*` env vars). `createWhatsAppAdapter` is now typed `(config?: WhatsAppAdapterConfig) => WhatsAppAdapter`. - `@chat-adapter/state-memory`: added an empty `MemoryStateAdapterOptions` type so the package matches every other state adapter; `createMemoryState` now accepts an optional argument of that type. - `@chat-adapter/state-ioredis`, `@chat-adapter/state-redis`, `@chat-adapter/state-pg`: the URL- and client-based option shapes were split into named interfaces (`*StateAdapterUrlOptions` / `*StateAdapterClientOptions`) and unified under `*StateAdapterOptions`. The factories now take the union type directly. Old names — `RedisStateClientOptions`, `CreateRedisStateOptions`, `PostgresStateClientOptions`, `CreatePostgresStateOptions`, `IoRedisStateClientOptions` — are kept as deprecated aliases. - Updated dependencies [ac8a207] - Updated dependencies [e60bc8c] - Updated dependencies [b75eedb] - chat@4.29.0 ## @chat-adapter/state-pg@4.29.0 ### Patch Changes - e60bc8c: chore: set supported Node versions in engines - 06fb8e5: Align package shapes with the new `konsistent` conventions. All changes are backwards-compatible — previous type names are kept as deprecated aliases. - `@chat-adapter/gchat`, `@chat-adapter/slack`: moved `*AdapterConfig` (and related sub-types) into a `./types` module; the public re-exports from `index.ts` are unchanged. - `@chat-adapter/slack`: `createSlackAdapter` now accepts `SlackAdapterConfig` directly instead of `Partial<SlackAdapterConfig>`. Every field on the config was already optional, so no call sites need to change. - `@chat-adapter/messenger`: `MessengerAdapterConfig` fields are now optional (the factory still falls back to `FACEBOOK_*` env vars), and `logger` / `userName` live on `MessengerAdapterConfig` directly. The factory signature is now `createMessengerAdapter(config?: MessengerAdapterConfig)`. - `@chat-adapter/web`: renamed `WebAdapterOptions` to `WebAdapterConfig`; the old name is exported as a deprecated alias. - `@chat-adapter/whatsapp`: every field on `WhatsAppAdapterConfig` is optional (the factory still falls back to `WHATSAPP_*` env vars). `createWhatsAppAdapter` is now typed `(config?: WhatsAppAdapterConfig) => WhatsAppAdapter`. - `@chat-adapter/state-memory`: added an empty `MemoryStateAdapterOptions` type so the package matches every other state adapter; `createMemoryState` now accepts an optional argument of that type. - `@chat-adapter/state-ioredis`, `@chat-adapter/state-redis`, `@chat-adapter/state-pg`: the URL- and client-based option shapes were split into named interfaces (`*StateAdapterUrlOptions` / `*StateAdapterClientOptions`) and unified under `*StateAdapterOptions`. The factories now take the union type directly. Old names — `RedisStateClientOptions`, `CreateRedisStateOptions`, `PostgresStateClientOptions`, `CreatePostgresStateOptions`, `IoRedisStateClientOptions` — are kept as deprecated aliases. - Updated dependencies [ac8a207] - Updated dependencies [e60bc8c] - Updated dependencies [b75eedb] - chat@4.29.0 ## @chat-adapter/state-redis@4.29.0 ### Patch Changes - e60bc8c: chore: set supported Node versions in engines - 06fb8e5: Align package shapes with the new `konsistent` conventions. All changes are backwards-compatible — previous type names are kept as deprecated aliases. - `@chat-adapter/gchat`, `@chat-adapter/slack`: moved `*AdapterConfig` (and related sub-types) into a `./types` module; the public re-exports from `index.ts` are unchanged. - `@chat-adapter/slack`: `createSlackAdapter` now accepts `SlackAdapterConfig` directly instead of `Partial<SlackAdapterConfig>`. Every field on the config was already optional, so no call sites need to change. - `@chat-adapter/messenger`: `MessengerAdapterConfig` fields are now optional (the factory still falls back to `FACEBOOK_*` env vars), and `logger` / `userName` live on `MessengerAdapterConfig` directly. The factory signature is now `createMessengerAdapter(config?: MessengerAdapterConfig)`. - `@chat-adapter/web`: renamed `WebAdapterOptions` to `WebAdapterConfig`; the old name is exported as a deprecated alias. - `@chat-adapter/whatsapp`: every field on `WhatsAppAdapterConfig` is optional (the factory still falls back to `WHATSAPP_*` env vars). `createWhatsAppAdapter` is now typed `(config?: WhatsAppAdapterConfig) => WhatsAppAdapter`. - `@chat-adapter/state-memory`: added an empty `MemoryStateAdapterOptions` type so the package matches every other state adapter; `createMemoryState` now accepts an optional argument of that type. - `@chat-adapter/state-ioredis`, `@chat-adapter/state-redis`, `@chat-adapter/state-pg`: the URL- and client-based option shapes were split into named interfaces (`*StateAdapterUrlOptions` / `*StateAdapterClientOptions`) and unified under `*StateAdapterOptions`. The factories now take the union type directly. Old names — `RedisStateClientOptions`, `CreateRedisStateOptions`, `PostgresStateClientOptions`, `CreatePostgresStateOptions`, `IoRedisStateClientOptions` — are kept as deprecated aliases. - Updated dependencies [ac8a207] - Updated dependencies [e60bc8c] - Updated dependencies [b75eedb] - chat@4.29.0 ## @chat-adapter/tests@4.29.0 ### Patch Changes - 0adf3ad: Add `@chat-adapter/tests` — Vitest factories, matchers, and setup utilities for Chat SDK adapter and bot authors. - **Factories**: `createMockAdapter`, `createMockChatInstance`, `createMockState` (with working in-memory subscriptions/locks/KV/queues), `createTestMessage`, `mockLogger`/`createMockLogger`. - **Matchers**: `toHavePosted(threadId, textPattern?)`, `toHaveDispatched(handler)`, `toBeSubscribedTo(threadId)`. - **Setup file**: `@chat-adapter/tests/setup` registers all matchers via `expect.extend` — drop into `vitest.config.ts` `setupFiles`. `chat` and `vitest` are peer dependencies. Adapter-specific helpers (e.g. signed Slack webhook builders) belong in each adapter's own `/testing` subpath, not in this kit. Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> @chat-adapter/state-redis@4.29.0 @chat-adapter/github@4.29.0 @chat-adapter/web@4.29.0 @chat-adapter/state-ioredis@4.29.0 @chat-adapter/telegram@4.29.0 @chat-adapter/messenger@4.29.0 @chat-adapter/discord@4.29.0 @chat-adapter/slack@4.29.0 chat@4.29.0 @chat-adapter/linear@4.29.0 @chat-adapter/state-pg@4.29.0 @chat-adapter/tests@4.29.0 @chat-adapter/teams@4.29.0 @chat-adapter/shared@4.29.0 @chat-adapter/gchat@4.29.0 @chat-adapter/whatsapp@4.29.0 @chat-adapter/state-memory@4.29.0	2026-05-18 07:16:55 -07:00
josh	9d7891b2f5	fix(release): prevent accidental major bumps (#520) ... ## summary fixes the release plan so peer-dependent packages only trigger major bumps when the next dependency version falls outside their supported range this keeps the current release on `4.29.0` instead of accidentally bumping the fixed `chat` and `@chat-adapter/*` group to `5.0.0` also changes `@chat-adapter/tests` to use a real `chat` peer range while keeping `workspace:*` for local development	2026-05-18 07:07:25 -07:00
josh	9f7bbc8482	fix(web): exclude framework wrappers from coverage (#512) ... ## summary excludes the Web adapter React, Vue, and Svelte wrapper entry points from coverage collection these files are thin framework-specific `useChat` wrappers that are already validated by build and typecheck, and excluding them avoids Vitest coverage trying to parse the Svelte wrapper as plain TypeScript	2026-05-14 20:27:20 -07:00
dependabot[bot]	b93ffa78a1	build(deps-dev): bump svelte from 5.55.5 to 5.55.7 (#511) ... Bumps [svelte](https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte) from 5.55.5 to 5.55.7. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sveltejs/svelte/releases">svelte's releases</a>.</em></p> <blockquote> <h2>svelte@5.55.7</h2> <h3>Patch Changes</h3> <ul> <li> <p>fix: prevent XSS on <code>hydratable</code> from user contents (<a href="https://github.com/sveltejs/svelte/commit/a16ebc67bbcf8f708360195687e1b2719463e1a4"><code>a16ebc67bbcf8f708360195687e1b2719463e1a4</code></a>)</p> </li> <li> <p>chore: bump devalue (<a href="https://redirect.github.com/sveltejs/svelte/pull/18219">#18219</a>)</p> </li> <li> <p>fix: disallow empty attribute names during SSR (<a href="https://github.com/sveltejs/svelte/commit/547853e2406a2147ad7fb5ffeba95b01bd9642da"><code>547853e2406a2147ad7fb5ffeba95b01bd9642da</code></a>)</p> </li> <li> <p>fix: harden regex (<a href="https://github.com/sveltejs/svelte/commit/d2375e2ebcab5c88feb5652f1a9d621b8f06b259"><code>d2375e2ebcab5c88feb5652f1a9d621b8f06b259</code></a>)</p> </li> <li> <p>fix: move Svelte runtime properties to symbols (<a href="https://github.com/sveltejs/svelte/commit/e1cbbd96441e82c9eb8a23a2903c0d06d3cda991"><code>e1cbbd96441e82c9eb8a23a2903c0d06d3cda991</code></a>)</p> </li> </ul> <h2>svelte@5.55.6</h2> <h3>Patch Changes</h3> <ul> <li> <p>fix: leave stale promises to wait for a later resolution, instead of rejecting (<a href="https://redirect.github.com/sveltejs/svelte/pull/18180">#18180</a>)</p> </li> <li> <p>fix: keep dependencies of <code>$state.eager/pending</code> (<a href="https://redirect.github.com/sveltejs/svelte/pull/18218">#18218</a>)</p> </li> <li> <p>fix: reapply context after transforming error during SSR (<a href="https://redirect.github.com/sveltejs/svelte/pull/18099">#18099</a>)</p> </li> <li> <p>fix: don't rebase just-created batches (<a href="https://redirect.github.com/sveltejs/svelte/pull/18117">#18117</a>)</p> </li> <li> <p>chore: allow <code>null</code> for <code>pending</code> in typings (<a href="https://redirect.github.com/sveltejs/svelte/pull/18201">#18201</a>)</p> </li> <li> <p>fix: flush eager effects in production (<a href="https://redirect.github.com/sveltejs/svelte/pull/18107">#18107</a>)</p> </li> <li> <p>fix: rethrow error of failed iterable after calling <code>return()</code> (<a href="https://redirect.github.com/sveltejs/svelte/pull/18169">#18169</a>)</p> </li> <li> <p>fix: account for proxified instance when updating <code>bind:this</code> (<a href="https://redirect.github.com/sveltejs/svelte/pull/18147">#18147</a>)</p> </li> <li> <p>fix: ensure scheduled batch is flushed if not obsolete (<a href="https://redirect.github.com/sveltejs/svelte/pull/18131">#18131</a>)</p> </li> <li> <p>fix: resolve stale deriveds with latest value (<a href="https://redirect.github.com/sveltejs/svelte/pull/18167">#18167</a>)</p> </li> <li> <p>chore: remove unnecessary <code>increment_pending</code> calls (<a href="https://redirect.github.com/sveltejs/svelte/pull/18183">#18183</a>)</p> </li> <li> <p>fix: correctly compile component member expressions for SSR (<a href="https://redirect.github.com/sveltejs/svelte/pull/18192">#18192</a>)</p> </li> <li> <p>fix: reset <code>source.updated</code> stack traces after <code>flush</code> (<a href="https://redirect.github.com/sveltejs/svelte/pull/18196">#18196</a>)</p> </li> <li> <p>fix: replacing async 'blocking' strategy with 'merging' (<a href="https://redirect.github.com/sveltejs/svelte/pull/18205">#18205</a>)</p> </li> <li> <p>fix: allow <code>@debug</code> tags to reference awaited variables (<a href="https://redirect.github.com/sveltejs/svelte/pull/18138">#18138</a>)</p> </li> <li> <p>fix: re-run fallback props if dependencies update (<a href="https://redirect.github.com/sveltejs/svelte/pull/18146">#18146</a>)</p> </li> <li> <p>fix: abort running obsolete async branches (<a href="https://redirect.github.com/sveltejs/svelte/pull/18118">#18118</a>)</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/sveltejs/svelte/blob/main/packages/svelte/CHANGELOG.md">svelte's changelog</a>.</em></p> <blockquote> <h2>5.55.7</h2> <h3>Patch Changes</h3> <ul> <li> <p>fix: prevent XSS on <code>hydratable</code> from user contents (<a href="https://github.com/sveltejs/svelte/commit/a16ebc67bbcf8f708360195687e1b2719463e1a4"><code>a16ebc67bbcf8f708360195687e1b2719463e1a4</code></a>)</p> </li> <li> <p>chore: bump devalue (<a href="https://redirect.github.com/sveltejs/svelte/pull/18219">#18219</a>)</p> </li> <li> <p>fix: disallow empty attribute names during SSR (<a href="https://github.com/sveltejs/svelte/commit/547853e2406a2147ad7fb5ffeba95b01bd9642da"><code>547853e2406a2147ad7fb5ffeba95b01bd9642da</code></a>)</p> </li> <li> <p>fix: harden regex (<a href="https://github.com/sveltejs/svelte/commit/d2375e2ebcab5c88feb5652f1a9d621b8f06b259"><code>d2375e2ebcab5c88feb5652f1a9d621b8f06b259</code></a>)</p> </li> <li> <p>fix: move Svelte runtime properties to symbols (<a href="https://github.com/sveltejs/svelte/commit/e1cbbd96441e82c9eb8a23a2903c0d06d3cda991"><code>e1cbbd96441e82c9eb8a23a2903c0d06d3cda991</code></a>)</p> </li> </ul> <h2>5.55.6</h2> <h3>Patch Changes</h3> <ul> <li> <p>fix: leave stale promises to wait for a later resolution, instead of rejecting (<a href="https://redirect.github.com/sveltejs/svelte/pull/18180">#18180</a>)</p> </li> <li> <p>fix: keep dependencies of <code>$state.eager/pending</code> (<a href="https://redirect.github.com/sveltejs/svelte/pull/18218">#18218</a>)</p> </li> <li> <p>fix: reapply context after transforming error during SSR (<a href="https://redirect.github.com/sveltejs/svelte/pull/18099">#18099</a>)</p> </li> <li> <p>fix: don't rebase just-created batches (<a href="https://redirect.github.com/sveltejs/svelte/pull/18117">#18117</a>)</p> </li> <li> <p>chore: allow <code>null</code> for <code>pending</code> in typings (<a href="https://redirect.github.com/sveltejs/svelte/pull/18201">#18201</a>)</p> </li> <li> <p>fix: flush eager effects in production (<a href="https://redirect.github.com/sveltejs/svelte/pull/18107">#18107</a>)</p> </li> <li> <p>fix: rethrow error of failed iterable after calling <code>return()</code> (<a href="https://redirect.github.com/sveltejs/svelte/pull/18169">#18169</a>)</p> </li> <li> <p>fix: account for proxified instance when updating <code>bind:this</code> (<a href="https://redirect.github.com/sveltejs/svelte/pull/18147">#18147</a>)</p> </li> <li> <p>fix: ensure scheduled batch is flushed if not obsolete (<a href="https://redirect.github.com/sveltejs/svelte/pull/18131">#18131</a>)</p> </li> <li> <p>fix: resolve stale deriveds with latest value (<a href="https://redirect.github.com/sveltejs/svelte/pull/18167">#18167</a>)</p> </li> <li> <p>chore: remove unnecessary <code>increment_pending</code> calls (<a href="https://redirect.github.com/sveltejs/svelte/pull/18183">#18183</a>)</p> </li> <li> <p>fix: correctly compile component member expressions for SSR (<a href="https://redirect.github.com/sveltejs/svelte/pull/18192">#18192</a>)</p> </li> <li> <p>fix: reset <code>source.updated</code> stack traces after <code>flush</code> (<a href="https://redirect.github.com/sveltejs/svelte/pull/18196">#18196</a>)</p> </li> <li> <p>fix: replacing async 'blocking' strategy with 'merging' (<a href="https://redirect.github.com/sveltejs/svelte/pull/18205">#18205</a>)</p> </li> <li> <p>fix: allow <code>@debug</code> tags to reference awaited variables (<a href="https://redirect.github.com/sveltejs/svelte/pull/18138">#18138</a>)</p> </li> <li> <p>fix: re-run fallback props if dependencies update (<a href="https://redirect.github.com/sveltejs/svelte/pull/18146">#18146</a>)</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sveltejs/svelte/commit/4d8f99a2709e3c02e48d8bc6c77458f4ba49d0e3"><code>4d8f99a</code></a> Version Packages (<a href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/18220">#18220</a>)</li> <li><a href="https://github.com/sveltejs/svelte/commit/05523088173e10af0753877af6936088de924833"><code>0552308</code></a> chore: bump devalue (<a href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/18219">#18219</a>)</li> <li><a href="https://github.com/sveltejs/svelte/commit/e1cbbd96441e82c9eb8a23a2903c0d06d3cda991"><code>e1cbbd9</code></a> Merge commit from fork</li> <li><a href="https://github.com/sveltejs/svelte/commit/a16ebc67bbcf8f708360195687e1b2719463e1a4"><code>a16ebc6</code></a> Merge commit from fork</li> <li><a href="https://github.com/sveltejs/svelte/commit/d2375e2ebcab5c88feb5652f1a9d621b8f06b259"><code>d2375e2</code></a> Merge commit from fork</li> <li><a href="https://github.com/sveltejs/svelte/commit/547853e2406a2147ad7fb5ffeba95b01bd9642da"><code>547853e</code></a> Merge commit from fork</li> <li><a href="https://github.com/sveltejs/svelte/commit/55f9c85c09d625c3dd80c71ce7542f57386fafb4"><code>55f9c85</code></a> Version Packages (<a href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/18158">#18158</a>)</li> <li><a href="https://github.com/sveltejs/svelte/commit/a10e8e47a5946623a60a1e36b9023c23926eae87"><code>a10e8e4</code></a> fix: keep dependencies of <code>$state.eager</code>/<code>pending</code> (alternative approach) (<a href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/1">#1</a>...</li> <li><a href="https://github.com/sveltejs/svelte/commit/ef4b97dfabfd7a23b27933e18f7393587c343d66"><code>ef4b97d</code></a> fix: duplicated &quot;of&quot; in events.js comment (<a href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/18217">#18217</a>)</li> <li><a href="https://github.com/sveltejs/svelte/commit/5122936edb3c14e9a602e579727479b49cbd3239"><code>5122936</code></a> fix: treat batches as a linked list (<a href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/18205">#18205</a>)</li> <li>Additional commits viewable in <a href="https://github.com/sveltejs/svelte/commits/svelte@5.55.7/packages/svelte">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-14 20:26:31 -07:00
dependabot[bot]	ee5e673fcd	build(deps): bump devalue from 5.6.3 to 5.8.0 (#510) ... Bumps [devalue](https://github.com/sveltejs/devalue) from 5.6.3 to 5.8.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sveltejs/devalue/releases">devalue's releases</a>.</em></p> <blockquote> <h2>v5.8.0</h2> <h3>Minor Changes</h3> <ul> <li>c5115b0: feat: add <code>stringifyAsync</code> for async serialization</li> </ul> <h2>v5.7.1</h2> <h3>Patch Changes</h3> <ul> <li>8becc7c: fix: handle regexes consistently in uneval's value and reference formats</li> </ul> <h2>v5.7.0</h2> <h3>Minor Changes</h3> <ul> <li>df2e284: feat: use native alternatives to encode/decode base64</li> <li>498656e: feat: add <code>DataView</code> support</li> <li>a210130: feat: whitelist <code>Float16Array</code></li> <li>df2e284: feat: simplify TypedArray slices</li> </ul> <h3>Patch Changes</h3> <ul> <li>5590634: fix: get <code>uneval</code> type handling up to parity with <code>stringify</code></li> <li>57f73fc: fix: correctly support boxed bigints and sentinel values</li> </ul> <h2>v5.6.4</h2> <h3>Patch Changes</h3> <ul> <li> <p>87c1f3c: fix: reject <code>__proto__</code> keys in malformed <code>Object</code> wrapper payloads</p> <p>This validates the <code>&quot;Object&quot;</code> parse path and throws when the wrapped value has an own <code>__proto__</code> key.</p> </li> <li> <p>40f1db1: fix: ensure sparse array indices are integers</p> </li> <li> <p>87c1f3c: fix: disallow <code>__proto__</code> keys in null-prototype object parsing</p> <p>This disallows <code>__proto__</code> keys in the <code>&quot;null&quot;</code> parse path so null-prototype object hydration cannot carry that key through parse/unflatten.</p> </li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/sveltejs/devalue/blob/main/CHANGELOG.md">devalue's changelog</a>.</em></p> <blockquote> <h2>5.8.0</h2> <h3>Minor Changes</h3> <ul> <li>c5115b0: feat: add <code>stringifyAsync</code> for async serialization</li> </ul> <h2>5.7.1</h2> <h3>Patch Changes</h3> <ul> <li>8becc7c: fix: handle regexes consistently in uneval's value and reference formats</li> </ul> <h2>5.7.0</h2> <h3>Minor Changes</h3> <ul> <li>df2e284: feat: use native alternatives to encode/decode base64</li> <li>498656e: feat: add <code>DataView</code> support</li> <li>a210130: feat: whitelist <code>Float16Array</code></li> <li>df2e284: feat: simplify TypedArray slices</li> </ul> <h3>Patch Changes</h3> <ul> <li>5590634: fix: get <code>uneval</code> type handling up to parity with <code>stringify</code></li> <li>57f73fc: fix: correctly support boxed bigints and sentinel values</li> </ul> <h2>5.6.4</h2> <h3>Patch Changes</h3> <ul> <li> <p>87c1f3c: fix: reject <code>__proto__</code> keys in malformed <code>Object</code> wrapper payloads</p> <p>This validates the <code>&quot;Object&quot;</code> parse path and throws when the wrapped value has an own <code>__proto__</code> key.</p> </li> <li> <p>40f1db1: fix: ensure sparse array indices are integers</p> </li> <li> <p>87c1f3c: fix: disallow <code>__proto__</code> keys in null-prototype object parsing</p> <p>This disallows <code>__proto__</code> keys in the <code>&quot;null&quot;</code> parse path so null-prototype object hydration cannot carry that key through parse/unflatten.</p> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sveltejs/devalue/commit/14933f78ff6b712829162628682b0a1993e75d19"><code>14933f7</code></a> Version Packages (<a href="https://redirect.github.com/sveltejs/devalue/issues/151">#151</a>)</li> <li><a href="https://github.com/sveltejs/devalue/commit/c5115b0074ec298fb4077f6cee5616cefbd13902"><code>c5115b0</code></a> feat: <code>stringifyAsync</code> (<a href="https://redirect.github.com/sveltejs/devalue/issues/150">#150</a>)</li> <li><a href="https://github.com/sveltejs/devalue/commit/67dad450b5db18ea9aa3059d334d8b0ee6704d9e"><code>67dad45</code></a> docs: update README to reflect serialization stability non-goal (<a href="https://redirect.github.com/sveltejs/devalue/issues/147">#147</a>)</li> <li><a href="https://github.com/sveltejs/devalue/commit/6eb920a7db6fe388f24f640d0e4e874a57f148fb"><code>6eb920a</code></a> Version Packages (<a href="https://redirect.github.com/sveltejs/devalue/issues/146">#146</a>)</li> <li><a href="https://github.com/sveltejs/devalue/commit/8becc7c436f0d4f85e2e5b32cb49dcfdf4fdec42"><code>8becc7c</code></a> fix: handle regexes consistently in uneval's value and reference formats (<a href="https://redirect.github.com/sveltejs/devalue/issues/145">#145</a>)</li> <li><a href="https://github.com/sveltejs/devalue/commit/2eee2e435ea0ea3d495dc7a266486df95a4eb6ed"><code>2eee2e4</code></a> Version Packages (<a href="https://redirect.github.com/sveltejs/devalue/issues/144">#144</a>)</li> <li><a href="https://github.com/sveltejs/devalue/commit/498656e75d36dfc63a386240722bdeac63337b25"><code>498656e</code></a> DataView support (<a href="https://redirect.github.com/sveltejs/devalue/issues/143">#143</a>)</li> <li><a href="https://github.com/sveltejs/devalue/commit/5590634db53ed555d3ce2e2024924b30352a6afc"><code>5590634</code></a> Improve platform types support (<a href="https://redirect.github.com/sveltejs/devalue/issues/142">#142</a>)</li> <li><a href="https://github.com/sveltejs/devalue/commit/57f73fc51389715d7ff27644b7b68e13397b6c1f"><code>57f73fc</code></a> fix: support boxed <code>bigint</code>s and sentinel values (<a href="https://redirect.github.com/sveltejs/devalue/issues/141">#141</a>)</li> <li><a href="https://github.com/sveltejs/devalue/commit/baec4cbcf1829de1d5da5d4512e4615186fe819e"><code>baec4cb</code></a> Add prettier configuration (<a href="https://redirect.github.com/sveltejs/devalue/issues/140">#140</a>)</li> <li>Additional commits viewable in <a href="https://github.com/sveltejs/devalue/compare/v5.6.3...v5.8.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/vercel/chat/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-14 20:26:01 -07:00
dependabot[bot]	a1416d35d3	build(deps): bump path-to-regexp from 0.1.13 to 8.4.2 (#509) ... Bumps [path-to-regexp](https://github.com/pillarjs/path-to-regexp) from 0.1.13 to 8.4.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pillarjs/path-to-regexp/releases">path-to-regexp's releases</a>.</em></p> <blockquote> <h2>v8.4.2</h2> <p><strong>Fixed</strong></p> <ul> <li>Error on trailing backslash (<a href="https://redirect.github.com/pillarjs/path-to-regexp/issues/434">#434</a>) 9a78879</li> </ul> <p><strong>Performance</strong></p> <ul> <li>Minimize array allocations (<a href="https://redirect.github.com/pillarjs/path-to-regexp/issues/437">#437</a>) 937c02d</li> <li>Improve compile performance (<a href="https://redirect.github.com/pillarjs/path-to-regexp/issues/436">#436</a>) 57247e6 <ul> <li>Should improve compilation performance by ~25%</li> </ul> </li> <li>Remove internal tokenization during parse (<a href="https://redirect.github.com/pillarjs/path-to-regexp/issues/435">#435</a>) 5844988 <ul> <li>Should improve parse performance by ~20%</li> </ul> </li> </ul> <p><strong>Bundle size</strong> to 1.93 kB, from 1.97 kB.</p> <hr /> <p><a href="https://github.com/pillarjs/path-to-regexp/compare/v8.4.1...v8.4.2">https://github.com/pillarjs/path-to-regexp/compare/v8.4.1...v8.4.2</a></p> <h2>v8.4.1</h2> <p><strong>Fixed</strong></p> <ul> <li>Remove trie deduplication (<a href="https://redirect.github.com/pillarjs/path-to-regexp/issues/431">#431</a>) 6bc8e84 <ul> <li>Using a trie required non-greedy matching, which regressed wildcards in non-ending mode by matching them up until the first match. For example: <ul> <li><code>/*foo</code> with <code>/a/b</code> = <code>/a</code></li> <li><code>/*foo.html</code>with <code>/a/b.html/c.html</code> = <code>/a/b.html</code></li> </ul> </li> </ul> </li> <li>Allow backtrack handling to match itself (<a href="https://redirect.github.com/pillarjs/path-to-regexp/issues/427">#427</a>) 5bcd30b <ul> <li>When backtracking was introduced, it rejected matching things like <code>/:&quot;a&quot;_:&quot;b&quot;</code> against <code>/foo__</code>. This makes intuitive sense because the second parameter is not going to backtrack on <code>_</code> anymore, but it's somewhat unexpected since there's no reason it shouldn't match the second <code>_</code>.</li> </ul> </li> </ul> <hr /> <p><a href="https://github.com/pillarjs/path-to-regexp/compare/v8.4.0...v8.4.1">https://github.com/pillarjs/path-to-regexp/compare/v8.4.0...v8.4.1</a></p> <h2>v8.4.0</h2> <p><strong>Important</strong></p> <ul> <li>Fix <a href="https://www.cve.org/CVERecord?id=CVE-2026-4926">CVE-2026-4926</a> (<a href="https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-j3q9-mxjg-w52f">GHSA-j3q9-mxjg-w52f</a>)</li> <li>Fix <a href="https://www.cve.org/CVERecord?id=CVE-2026-4923">CVE-2026-4923</a> (<a href="https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-27v5-c462-wpq7">GHSA-27v5-c462-wpq7</a>)</li> </ul> <p><strong>Fixed</strong></p> <ul> <li>Restricts wildcard backtracking when using more than 1 in a path (<a href="https://redirect.github.com/pillarjs/path-to-regexp/pull/421">pillarjs/path-to-regexp#421</a>)</li> </ul> <p><strong>Changed</strong></p> <ul> <li>Dedupes regex prefixes (<a href="https://redirect.github.com/pillarjs/path-to-regexp/pull/422">pillarjs/path-to-regexp#422</a>) <ul> <li>This will result in shorter regular expressions for some cases using optional groups</li> </ul> </li> <li>Rejects large optional route combinations (<a href="https://redirect.github.com/pillarjs/path-to-regexp/pull/424">pillarjs/path-to-regexp#424</a>) <ul> <li>When using groups such as <code>/users{/delete}</code> it will restrict the number of generated combinations to &lt; 256, equivalent to 8 top-level optional groups and unlikely to occur in a real world application, but avoids exploding the regex size for applications that accept user created routes</li> </ul> </li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/pillarjs/path-to-regexp/blob/master/History.md">path-to-regexp's changelog</a>.</em></p> <blockquote> <h1>Moved to <a href="https://github.com/pillarjs/path-to-regexp/releases">GitHub Releases</a></h1> <h2>3.0.0 / 2019-01-13</h2> <ul> <li>Always use prefix character as delimiter token, allowing any character to be a delimiter (e.g. <code>/:att1-:att2-:att3-:att4-:att5</code>)</li> <li>Remove <code>partial</code> support, prefer escaping the prefix delimiter explicitly (e.g. <code>\\/(apple-)?icon-:res(\\d+).png</code>)</li> </ul> <h2>2.4.0 / 2018-08-26</h2> <ul> <li>Support <code>start</code> option to disable anchoring from beginning of the string</li> </ul> <h2>2.3.0 / 2018-08-20</h2> <ul> <li>Use <code>delimiter</code> when processing repeated matching groups (e.g. <code>foo/bar</code> has no prefix, but has a delimiter)</li> </ul> <h2>2.2.1 / 2018-04-24</h2> <ul> <li>Allow empty string with <code>end: false</code> to match both relative and absolute paths</li> </ul> <h2>2.2.0 / 2018-03-06</h2> <ul> <li>Pass <code>token</code> as second argument to <code>encode</code> option (e.g. <code>encode(value, token)</code>)</li> </ul> <h2>2.1.0 / 2017-10-20</h2> <ul> <li>Handle non-ending paths where the final character is a delimiter <ul> <li>E.g. <code>/foo/</code> before required either <code>/foo/</code> or <code>/foo//</code> to match in non-ending mode</li> </ul> </li> </ul> <h2>2.0.0 / 2017-08-23</h2> <ul> <li>New option! Ability to set <code>endsWith</code> to match paths like <code>/test?query=string</code> up to the query string</li> <li>New option! Set <code>delimiters</code> for specific characters to be treated as parameter prefixes (e.g. <code>/:test</code>)</li> <li>Remove <code>isarray</code> dependency</li> <li>Explicitly handle trailing delimiters instead of trimming them (e.g. <code>/test/</code> is now treated as <code>/test/</code> instead of <code>/test</code> when matching)</li> <li>Remove overloaded <code>keys</code> argument that accepted <code>options</code></li> <li>Remove <code>keys</code> list attached to the <code>RegExp</code> output</li> <li>Remove asterisk functionality (it's a real pain to properly encode)</li> <li>Change <code>tokensToFunction</code> (e.g. <code>compile</code>) to accept an <code>encode</code> function for pretty encoding (e.g. pass your own implementation)</li> </ul> <h2>1.7.0 / 2016-11-08</h2> <ul> <li>Allow a <code>delimiter</code> option to be passed in with <code>tokensToRegExp</code> which will be used for &quot;non-ending&quot; token match situations</li> </ul> <h2>1.6.0 / 2016-10-03</h2> <ul> <li>Populate <code>RegExp.keys</code> when using the <code>tokensToRegExp</code> method (making it consistent with the main export)</li> <li>Allow a <code>delimiter</code> option to be passed in with <code>parse</code></li> <li>Updated TypeScript definition with <code>Keys</code> and <code>Options</code> updated</li> </ul> <h2>1.5.3 / 2016-06-15</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pillarjs/path-to-regexp/commit/cbf30259e6d34d6135f9e7dbaa3371e7188f9936"><code>cbf3025</code></a> 8.4.2</li> <li><a href="https://github.com/pillarjs/path-to-regexp/commit/937c02df571aef02832610100859efab21995320"><code>937c02d</code></a> Minimize array allocations (<a href="https://redirect.github.com/pillarjs/path-to-regexp/issues/437">#437</a>)</li> <li><a href="https://github.com/pillarjs/path-to-regexp/commit/57247e63fd061aa17b9f75c87712c680b223ee04"><code>57247e6</code></a> Improve compile performance (<a href="https://redirect.github.com/pillarjs/path-to-regexp/issues/436">#436</a>)</li> <li><a href="https://github.com/pillarjs/path-to-regexp/commit/58449883539022c9ac36ea3e9abb0fc7b9d84223"><code>5844988</code></a> Remove internal tokenization during parse (<a href="https://redirect.github.com/pillarjs/path-to-regexp/issues/435">#435</a>)</li> <li><a href="https://github.com/pillarjs/path-to-regexp/commit/9a788793e7eeb0ccf9c53c1cb54d297b5badfcc3"><code>9a78879</code></a> Error on trailing backslash (<a href="https://redirect.github.com/pillarjs/path-to-regexp/issues/434">#434</a>)</li> <li><a href="https://github.com/pillarjs/path-to-regexp/commit/7f058760ae0867fdd75e5ed07d7096f782c1f752"><code>7f05876</code></a> 8.4.1</li> <li><a href="https://github.com/pillarjs/path-to-regexp/commit/6bc8e84677caa52de6db7b2b17a6729ec155b070"><code>6bc8e84</code></a> Remove trie deduplication (<a href="https://redirect.github.com/pillarjs/path-to-regexp/issues/431">#431</a>)</li> <li><a href="https://github.com/pillarjs/path-to-regexp/commit/5bcd30b790fecfd4798521af28a57214996c4139"><code>5bcd30b</code></a> Allow backtrack handling to match itself (<a href="https://redirect.github.com/pillarjs/path-to-regexp/issues/427">#427</a>)</li> <li><a href="https://github.com/pillarjs/path-to-regexp/commit/9f9c6c501f6d015db3df224d2479475d59cac0a5"><code>9f9c6c5</code></a> Add parsing to benchmarks (<a href="https://redirect.github.com/pillarjs/path-to-regexp/issues/418">#418</a>)</li> <li><a href="https://github.com/pillarjs/path-to-regexp/commit/9fd31e0cde4f35b5f15f1676eabe3484618038ad"><code>9fd31e0</code></a> Add <code>trailing: false</code> tests (<a href="https://redirect.github.com/pillarjs/path-to-regexp/issues/428">#428</a>)</li> <li>Additional commits viewable in <a href="https://github.com/pillarjs/path-to-regexp/compare/v.0.1.13...v8.4.2">compare view</a></li> </ul> </details> <details> <summary>Install script changes</summary> <p>This version adds <code>prepare</code> script that runs during installation. Review the package contents before updating.</p> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/vercel/chat/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-14 20:25:41 -07:00
dependabot[bot]	76b28363b6	build(deps): bump undici from 6.21.3 to 7.22.0 (#508) ... Bumps [undici](https://github.com/nodejs/undici) from 6.21.3 to 7.22.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/nodejs/undici/releases">undici's releases</a>.</em></p> <blockquote> <h2>v7.22.0</h2> <h2>What's Changed</h2> <ul> <li>docs: fix syntax highlighting in WebSocket.md by <a href="https://github.com/styfle"><code>@​styfle</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4814">nodejs/undici#4814</a></li> <li>fix: use OR operator in includesCredentials per WHATWG URL Standard by <a href="https://github.com/jackhax"><code>@​jackhax</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4816">nodejs/undici#4816</a></li> <li>feat(dispatcher/env-http-proxy-agent): strip leading dot and asterisk by <a href="https://github.com/SuperOleg39"><code>@​SuperOleg39</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4676">nodejs/undici#4676</a></li> <li>fix: route WebSocket upgrades through onRequestUpgrade by <a href="https://github.com/mcollina"><code>@​mcollina</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4787">nodejs/undici#4787</a></li> <li>build(deps-dev): bump esbuild from 0.25.12 to 0.27.3 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/nodejs/undici/pull/4821">nodejs/undici#4821</a></li> <li>fix(deduplicate): do not deduplicate non-safe methods by default by <a href="https://github.com/mcollina"><code>@​mcollina</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4818">nodejs/undici#4818</a></li> <li>feat: Support async cache stores in revalidation by <a href="https://github.com/marcopiraccini"><code>@​marcopiraccini</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4826">nodejs/undici#4826</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/jackhax"><code>@​jackhax</code></a> made their first contribution in <a href="https://redirect.github.com/nodejs/undici/pull/4816">nodejs/undici#4816</a></li> <li><a href="https://github.com/marcopiraccini"><code>@​marcopiraccini</code></a> made their first contribution in <a href="https://redirect.github.com/nodejs/undici/pull/4826">nodejs/undici#4826</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/nodejs/undici/compare/v7.21.0...v7.22.0">https://github.com/nodejs/undici/compare/v7.21.0...v7.22.0</a></p> <h2>v7.21.0</h2> <h2>What's Changed</h2> <ul> <li>build(deps): bump actions/setup-node from 6.0.0 to 6.2.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/nodejs/undici/pull/4796">nodejs/undici#4796</a></li> <li>test: restore global dispatcher after fetch tests by <a href="https://github.com/mcollina"><code>@​mcollina</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4790">nodejs/undici#4790</a></li> <li>Add missing <code>close</code> method to WebSocketStream interface by <a href="https://github.com/piotr-cz"><code>@​piotr-cz</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4802">nodejs/undici#4802</a></li> <li>fix: error stream instead of canceling by <a href="https://github.com/KhafraDev"><code>@​KhafraDev</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4804">nodejs/undici#4804</a></li> <li>Fix clientTtl cleanup race in Agent by <a href="https://github.com/mcollina"><code>@​mcollina</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4807">nodejs/undici#4807</a></li> <li>feat(<a href="https://redirect.github.com/nodejs/undici/issues/4230">#4230</a>): Implement pingInterval for dispatching PING frames by <a href="https://github.com/metcoder95"><code>@​metcoder95</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4296">nodejs/undici#4296</a></li> <li>fix: handle undefined __filename in bundled environments by <a href="https://github.com/mcollina"><code>@​mcollina</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4812">nodejs/undici#4812</a></li> <li>fix: set finalizer only for fetch responses by <a href="https://github.com/tsctx"><code>@​tsctx</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4803">nodejs/undici#4803</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/piotr-cz"><code>@​piotr-cz</code></a> made their first contribution in <a href="https://redirect.github.com/nodejs/undici/pull/4802">nodejs/undici#4802</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/nodejs/undici/compare/v7.20.0...v7.21.0">https://github.com/nodejs/undici/compare/v7.20.0...v7.21.0</a></p> <h2>v7.20.0</h2> <h2>What's Changed</h2> <ul> <li>fix: preserve fetch stack traces by <a href="https://github.com/mcollina"><code>@​mcollina</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4778">nodejs/undici#4778</a></li> <li>Fix error handling in MockPool example by <a href="https://github.com/dave-kennedy"><code>@​dave-kennedy</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4781">nodejs/undici#4781</a></li> <li>feat: expose statusText in request() ResponseData by <a href="https://github.com/domenic"><code>@​domenic</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4784">nodejs/undici#4784</a></li> <li>test: reduce retry-after invalid date flake by <a href="https://github.com/mcollina"><code>@​mcollina</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4788">nodejs/undici#4788</a></li> <li>extractBody fixes by <a href="https://github.com/KhafraDev"><code>@​KhafraDev</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4791">nodejs/undici#4791</a></li> <li>fix: MockAgent delayed response with AbortSignal (<a href="https://redirect.github.com/nodejs/undici/issues/4693">#4693</a>) by <a href="https://github.com/mcollina"><code>@​mcollina</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4772">nodejs/undici#4772</a></li> <li>fix: onParserTimeout potentially accessing undefined by <a href="https://github.com/vbfox"><code>@​vbfox</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/4758">nodejs/undici#4758</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/dave-kennedy"><code>@​dave-kennedy</code></a> made their first contribution in <a href="https://redirect.github.com/nodejs/undici/pull/4781">nodejs/undici#4781</a></li> <li><a href="https://github.com/vbfox"><code>@​vbfox</code></a> made their first contribution in <a href="https://redirect.github.com/nodejs/undici/pull/4758">nodejs/undici#4758</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/nodejs/undici/compare/v7.19.2...v7.20.0">https://github.com/nodejs/undici/compare/v7.19.2...v7.20.0</a></p> <h2>v7.19.2</h2> <h2>What's Changed</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/nodejs/undici/commit/0a236106a3a3e1b0aab424f71de2a68ca2c1d37b"><code>0a23610</code></a> Bumped v7.22.0 (<a href="https://redirect.github.com/nodejs/undici/issues/4829">#4829</a>)</li> <li><a href="https://github.com/nodejs/undici/commit/f3c5c614901e4ba29f2f60730c3d4f28e60a5186"><code>f3c5c61</code></a> feat: Support async cache stores in revalidation (<a href="https://redirect.github.com/nodejs/undici/issues/4826">#4826</a>)</li> <li><a href="https://github.com/nodejs/undici/commit/9b78a44eb21cabe0451263ef8e3cfc7ad8e40876"><code>9b78a44</code></a> fix(deduplicate): avoid deduping methods not in methods option (<a href="https://redirect.github.com/nodejs/undici/issues/4818">#4818</a>)</li> <li><a href="https://github.com/nodejs/undici/commit/0ce57bad2c171a16c043c8234317ef5383f86e0b"><code>0ce57ba</code></a> build(deps-dev): bump esbuild from 0.25.12 to 0.27.3 (<a href="https://redirect.github.com/nodejs/undici/issues/4821">#4821</a>)</li> <li><a href="https://github.com/nodejs/undici/commit/2453caf93824997c24383e5a84fddbfa783113b0"><code>2453caf</code></a> fix: route websocket upgrades through new handler API (<a href="https://redirect.github.com/nodejs/undici/issues/4787">#4787</a>)</li> <li><a href="https://github.com/nodejs/undici/commit/4658cdf5eacf3f6692ec96811a0e49e6b9bc060a"><code>4658cdf</code></a> feat(dispatcher/env-http-proxy-agent): strip leading dot and asterisk (<a href="https://redirect.github.com/nodejs/undici/issues/4676">#4676</a>)</li> <li><a href="https://github.com/nodejs/undici/commit/a821c5669fa653364649d8fb7b36957702c548f5"><code>a821c56</code></a> fix: use OR operator in includesCredentials per WHATWG URL Standard (<a href="https://redirect.github.com/nodejs/undici/issues/4816">#4816</a>)</li> <li><a href="https://github.com/nodejs/undici/commit/b3326b58969e2370a7da77d80dbad4df2f36ca1e"><code>b3326b5</code></a> docs: fix syntax highlighting in WebSocket.md (<a href="https://redirect.github.com/nodejs/undici/issues/4814">#4814</a>)</li> <li><a href="https://github.com/nodejs/undici/commit/393c0da68691a6da8ea0a774e38bcce2889be89e"><code>393c0da</code></a> Bumped v7.21.0 (<a href="https://redirect.github.com/nodejs/undici/issues/4813">#4813</a>)</li> <li><a href="https://github.com/nodejs/undici/commit/47f9b9664759d18d30c3c8f321425bee102e1df3"><code>47f9b96</code></a> fix: set finalizer only for fetch responses (<a href="https://redirect.github.com/nodejs/undici/issues/4803">#4803</a>)</li> <li>Additional commits viewable in <a href="https://github.com/nodejs/undici/compare/v6.21.3...v7.22.0">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for undici since your current version.</p> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/vercel/chat/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-14 20:24:55 -07:00
dependabot[bot]	5a1d98cd7e	build(deps): bump minimatch from 5.1.9 to 10.2.5 (#507) ... Bumps [minimatch](https://github.com/isaacs/minimatch) from 5.1.9 to 10.2.5. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/isaacs/minimatch/blob/main/changelog.md">minimatch's changelog</a>.</em></p> <blockquote> <h1>change log</h1> <h2>10.2</h2> <ul> <li>Add <code>braceExpandMax</code> option</li> </ul> <h2>10.1</h2> <ul> <li>Add <code>magicalBraces</code> option for <code>escape</code></li> <li>Fix <code>makeRe</code> when <code>partial: true</code> is set.</li> <li>Fix <code>makeRe</code> when pattern ends in a final <code>**</code> path part.</li> </ul> <h2>10.0</h2> <ul> <li>Require node 20 or 22 and higher</li> </ul> <h2>9.0</h2> <ul> <li>No default export, only named exports.</li> </ul> <h2>8.0</h2> <ul> <li>Recursive descent parser for extglob, allowing correct support for arbitrarily nested extglob expressions</li> <li>Bump required Node.js version</li> </ul> <h2>7.4</h2> <ul> <li>Add <code>escape()</code> method</li> <li>Add <code>unescape()</code> method</li> <li>Add <code>Minimatch.hasMagic()</code> method</li> </ul> <h2>7.3</h2> <ul> <li>Add support for posix character classes in a unicode-aware way.</li> </ul> <h2>7.2</h2> <ul> <li>Add <code>windowsNoMagicRoot</code> option</li> </ul> <h2>7.1</h2> <ul> <li>Add <code>optimizationLevel</code> configuration option, and revert the default back to the 6.2 style minimal optimizations, making the advanced transforms introduced in 7.0 opt-in. Also, process provided file paths in the same way in optimizationLevel:2 mode, so <em>most</em> things that matched with optimizationLevel 1 or 0 <em>should</em> match with level 2 as well. However, level 1 is the default, out of an abundance of caution.</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/isaacs/minimatch/commit/693c82377d0948401be4c6d3220c9a74132ab112"><code>693c823</code></a> 10.2.5</li> <li><a href="https://github.com/isaacs/minimatch/commit/7953af1fac53267c05e362f036b70de898318faa"><code>7953af1</code></a> do not allow .. to consume drive letter on Windows</li> <li><a href="https://github.com/isaacs/minimatch/commit/1caf91893b67586255c68e2e513b14ac66785a24"><code>1caf918</code></a> lint and format</li> <li><a href="https://github.com/isaacs/minimatch/commit/7783ed6670442acb4d455b9b164a1b2a33507a45"><code>7783ed6</code></a> ignore docs</li> <li><a href="https://github.com/isaacs/minimatch/commit/6d9b356cd59372de00e1d5f3b8907a3350b9b8e5"><code>6d9b356</code></a> update deps etc</li> <li><a href="https://github.com/isaacs/minimatch/commit/c36addb94e33f14254b9ca9017e63ae9c9d80d1d"><code>c36addb</code></a> 10.2.4</li> <li><a href="https://github.com/isaacs/minimatch/commit/26b90027d5ad0c383b5253a4e45d6dc7da282db4"><code>26b9002</code></a> docs: add warning about ReDoS</li> <li><a href="https://github.com/isaacs/minimatch/commit/3a0d83b6f03a17ebc15361c2faa7110777042aab"><code>3a0d83b</code></a> fix partial matching of globstar patterns</li> <li><a href="https://github.com/isaacs/minimatch/commit/ea94840326c3f40522f1b544bd2303024b0eec35"><code>ea94840</code></a> 10.2.3</li> <li><a href="https://github.com/isaacs/minimatch/commit/0873fbabc00a86e09f4469386059a71abb136c93"><code>0873fba</code></a> update deps</li> <li>Additional commits viewable in <a href="https://github.com/isaacs/minimatch/compare/v5.1.9...v10.2.5">compare view</a></li> </ul> </details> <details> <summary>Install script changes</summary> <p>This version adds <code>prepare</code> script that runs during installation. Review the package contents before updating.</p> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-14 20:24:34 -07:00
dependabot[bot]	5b44996390	build(deps): bump brace-expansion from 2.0.2 to 5.0.5 (#506) ... Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) from 2.0.2 to 5.0.5. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/juliangruber/brace-expansion/releases">brace-expansion's releases</a>.</em></p> <blockquote> <h2>v4.0.1</h2> <ul> <li>fmt 5a5cc17</li> <li>Fix potential ReDoS Vulnerability or Inefficient Regular Expression (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/65">#65</a>) 0b6a978</li> </ul> <hr /> <p><a href="https://github.com/juliangruber/brace-expansion/compare/v4.0.0...v4.0.1">https://github.com/juliangruber/brace-expansion/compare/v4.0.0...v4.0.1</a></p> <h2>v4.0.0</h2> <ul> <li>feat: use string replaces instead of splits (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/64">#64</a>) 278132b</li> <li>fmt dd72a59</li> <li>add <code>tea.yaml</code> 70e4c1b</li> </ul> <p><a href="https://github.com/juliangruber/brace-expansion/compare/v3.0.0...v4.0.0">https://github.com/juliangruber/brace-expansion/compare/v3.0.0...v4.0.0</a></p> <p>As a precaution to not risk breaking anything with 278132b, this is a new semver major release</p> <h2>v3.0.1</h2> <ul> <li>pkg: publish on tag 3.x 3059c07</li> <li>fmt 8229e6f</li> <li>Fix potential ReDoS Vulnerability or Inefficient Regular Expression (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/65">#65</a>) 15f9b3c</li> </ul> <hr /> <p><a href="https://github.com/juliangruber/brace-expansion/compare/v3.0.0...v3.0.1">https://github.com/juliangruber/brace-expansion/compare/v3.0.0...v3.0.1</a></p> <h2>v3.0.0</h2> <ul> <li>Switch to ES Modules and balanced-match 3.0.0 (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/62">#62</a>) c0360e8</li> <li>added jsdoc (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/55">#55</a>) 68c0e37</li> <li>node 16 is EOL 9e781e9</li> <li>add standard 3494c4d</li> <li>use const and let (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/57">#57</a>) dd5a4cb</li> <li>docs 6dad209</li> <li>remove <code>test</code> e3dd8ae</li> <li>ci: update node versions d23ede9</li> <li>docs: add <a href="https://github.com/lanodan"><code>@​lanodan</code></a> to contributors 1eb3fa4</li> <li>docs 1e7c9cd</li> <li>switch from tape to test module (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/60">#60</a>) 2520537</li> <li>Bump minimist from 1.2.5 to 1.2.6 (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/59">#59</a>) 61a94f1</li> <li>Bump path-parse from 1.0.6 to 1.0.7 (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/51">#51</a>) dc741cf</li> <li>docs: add back ci badge 8ee5626</li> <li>Add github actions, remove travis. Closes <a href="https://redirect.github.com/juliangruber/brace-expansion/issues/52">#52</a> (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/53">#53</a>) 5c8756a</li> <li>CI: Drop unused sudo: false Travis directive (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/50">#50</a>) 05978a7</li> </ul> <p><a href="https://github.com/juliangruber/brace-expansion/compare/v2.0.1...v3.0.0">https://github.com/juliangruber/brace-expansion/compare/v2.0.1...v3.0.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/juliangruber/brace-expansion/commit/87939017c6cb6be56b98c6fa2059b073315cd534"><code>8793901</code></a> 5.0.5</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051"><code>9a02af5</code></a> Merge commit from fork</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a"><code>daa71bc</code></a> Bump tar from 7.5.10 to 7.5.11 (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/92">#92</a>)</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/799e5f7a222b0ea29052090b80fab2125a846543"><code>799e5f7</code></a> Bump tar from 7.5.9 to 7.5.10 (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/90">#90</a>)</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/012c230b7f71ca0c43febfa2dc3b710f63f129dd"><code>012c230</code></a> 5.0.4</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/243c491714270462decf1293b395e0aa6f6c15c4"><code>243c491</code></a> Fix handling of brackets. Closes <a href="https://redirect.github.com/juliangruber/brace-expansion/issues/87">#87</a></li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/609f8588070198ca6ff7132d2f78bbae5c991b93"><code>609f858</code></a> Correct incorrect brace-expansion import (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/89">#89</a>)</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/3c51e2c3fd4af2e982f702e517fb6887cefdf509"><code>3c51e2c</code></a> 5.0.3</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/48c30d975c6b636383f9fc0c7f994f0b4da232d7"><code>48c30d9</code></a> chore: support node 18 (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/85">#85</a>)</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/d673911cfb1578bea6ea2df28b4a4bc37b191a5b"><code>d673911</code></a> Bump tar from 7.5.7 to 7.5.9 (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/84">#84</a>)</li> <li>Additional commits viewable in <a href="https://github.com/juliangruber/brace-expansion/compare/v2.0.2...v5.0.5">compare view</a></li> </ul> </details> <details> <summary>Install script changes</summary> <p>This version adds <code>prepare</code> script that runs during installation. Review the package contents before updating.</p> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/vercel/chat/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-14 20:24:12 -07:00
dependabot[bot]	fcb5018bb4	build(deps): bump picomatch from 2.3.1 to 4.0.4 (#505) ... Bumps [picomatch](https://github.com/micromatch/picomatch) from 2.3.1 to 4.0.4. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/micromatch/picomatch/releases">picomatch's releases</a>.</em></p> <blockquote> <h2>4.0.4</h2> <p>This is a security release fixing several security relevant issues.</p> <h2>What's Changed</h2> <ul> <li>Fix for <a href="https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj">CVE-2026-33671</a></li> <li>Fix for <a href="https://github.com/micromatch/picomatch/security/advisories/GHSA-3v7f-55p6-f55p">CVE-2026-33672</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/micromatch/picomatch/compare/4.0.3...4.0.4">https://github.com/micromatch/picomatch/compare/4.0.3...4.0.4</a></p> <h2>4.0.3</h2> <h2>What's Changed</h2> <ul> <li>fix: exception when glob pattern contains <code>constructor</code> by <a href="https://github.com/Jason3S"><code>@​Jason3S</code></a> in <a href="https://redirect.github.com/micromatch/picomatch/pull/144">micromatch/picomatch#144</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/Jason3S"><code>@​Jason3S</code></a> made their first contribution in <a href="https://redirect.github.com/micromatch/picomatch/pull/144">micromatch/picomatch#144</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/micromatch/picomatch/compare/4.0.2...4.0.3">https://github.com/micromatch/picomatch/compare/4.0.2...4.0.3</a></p> <h2>3.0.2</h2> <p>This is a security release fixing several security relevant issues.</p> <h2>What's Changed</h2> <ul> <li>fix: exception when glob pattern contains constructor by <a href="https://github.com/Jason3S"><code>@​Jason3S</code></a> in <a href="https://redirect.github.com/micromatch/picomatch/pull/144">micromatch/picomatch#144</a></li> <li>Fix for <a href="https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj">CVE-2026-33671</a></li> <li>Fix for <a href="https://github.com/micromatch/picomatch/security/advisories/GHSA-3v7f-55p6-f55p">CVE-2026-33672</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/micromatch/picomatch/compare/3.0.1...3.0.2">https://github.com/micromatch/picomatch/compare/3.0.1...3.0.2</a></p> <h2>2.3.2</h2> <p>This is a security release fixing several security relevant issues.</p> <h2>What's Changed</h2> <ul> <li>fix: exception when glob pattern contains constructor by <a href="https://github.com/Jason3S"><code>@​Jason3S</code></a> in <a href="https://redirect.github.com/micromatch/picomatch/pull/144">micromatch/picomatch#144</a></li> <li>Fix for <a href="https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj">CVE-2026-33671</a></li> <li>Fix for <a href="https://github.com/micromatch/picomatch/security/advisories/GHSA-3v7f-55p6-f55p">CVE-2026-33672</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/micromatch/picomatch/compare/2.3.1...2.3.2">https://github.com/micromatch/picomatch/compare/2.3.1...2.3.2</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md">picomatch's changelog</a>.</em></p> <blockquote> <h1>Release history</h1> <p><strong>All notable changes to this project will be documented in this file.</strong></p> <p>The format is based on <a href="http://keepachangelog.com/en/1.0.0/">Keep a Changelog</a> and this project adheres to <a href="http://semver.org/spec/v2.0.0.html">Semantic Versioning</a>.</p> <!-- raw HTML omitted --> <ul> <li>Changelogs are for humans, not machines.</li> <li>There should be an entry for every single version.</li> <li>The same types of changes should be grouped.</li> <li>Versions and sections should be linkable.</li> <li>The latest version comes first.</li> <li>The release date of each versions is displayed.</li> <li>Mention whether you follow Semantic Versioning.</li> </ul> <!-- raw HTML omitted --> <!-- raw HTML omitted --> <p>Changelog entries are classified using the following labels <em>(from <a href="http://keepachangelog.com/">keep-a-changelog</a></em>):</p> <ul> <li><code>Added</code> for new features.</li> <li><code>Changed</code> for changes in existing functionality.</li> <li><code>Deprecated</code> for soon-to-be removed features.</li> <li><code>Removed</code> for now removed features.</li> <li><code>Fixed</code> for any bug fixes.</li> <li><code>Security</code> in case of vulnerabilities.</li> </ul> <!-- raw HTML omitted --> <h2>4.0.0 (2024-02-07)</h2> <h3>Fixes</h3> <ul> <li>Fix bad text values in parse <a href="https://redirect.github.com/micromatch/picomatch/issues/126">#126</a>, thanks to <a href="https://github.com/connor4312"><code>@​connor4312</code></a></li> </ul> <h3>Changed</h3> <ul> <li>Remove process global to work outside of node <a href="https://redirect.github.com/micromatch/picomatch/issues/129">#129</a>, thanks to <a href="https://github.com/styfle"><code>@​styfle</code></a></li> <li>Add sideEffects to package.json <a href="https://redirect.github.com/micromatch/picomatch/issues/128">#128</a>, thanks to <a href="https://github.com/frandiox"><code>@​frandiox</code></a></li> <li>Removed <code>os</code>, make compatible browser environment. See <a href="https://redirect.github.com/micromatch/picomatch/issues/124">#124</a>, thanks to <a href="https://github.com/gwsbhqt"><code>@​gwsbhqt</code></a></li> </ul> <h2>3.0.1</h2> <h3>Fixes</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/micromatch/picomatch/commit/e5474fc1a4d7991870058170407dda8a42be5334"><code>e5474fc</code></a> Publish 4.0.4</li> <li><a href="https://github.com/micromatch/picomatch/commit/4516eb521f13a46b2fe1a1d2c9ef6b20ddc0e903"><code>4516eb5</code></a> Merge commit from fork</li> <li><a href="https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d"><code>5eceecd</code></a> Merge commit from fork</li> <li><a href="https://github.com/micromatch/picomatch/commit/0db7dd70651ca7c8265601c0442a996ed32e3238"><code>0db7dd7</code></a> Run benchmark again against latest minimatch version (<a href="https://redirect.github.com/micromatch/picomatch/issues/161">#161</a>)</li> <li><a href="https://github.com/micromatch/picomatch/commit/95003777eb1c60dec09495a8231fa2ba4054d76a"><code>9500377</code></a> docs: clarify what brace expansion syntax is and isn't supported (<a href="https://redirect.github.com/micromatch/picomatch/issues/134">#134</a>)</li> <li><a href="https://github.com/micromatch/picomatch/commit/2661f23eca86c8b4a2b14815b9b2b3b74bd5a171"><code>2661f23</code></a> fix typo in globstars.js test name (<a href="https://redirect.github.com/micromatch/picomatch/issues/138">#138</a>)</li> <li><a href="https://github.com/micromatch/picomatch/commit/1798b07e9df59500b9cf567294d44d559032f4c7"><code>1798b07</code></a> docs: fix <code>makeRe</code> example (<a href="https://redirect.github.com/micromatch/picomatch/issues/143">#143</a>)</li> <li><a href="https://github.com/micromatch/picomatch/commit/9d76bc57a03b7f57cc4ca516c8071daf632bafd8"><code>9d76bc5</code></a> chore: undocument removed options (<a href="https://redirect.github.com/micromatch/picomatch/issues/146">#146</a>)</li> <li><a href="https://github.com/micromatch/picomatch/commit/e4d718bbfb47e4f030ab2612b5b04a9297fe272d"><code>e4d718b</code></a> Remove unused time-require (<a href="https://redirect.github.com/micromatch/picomatch/issues/160">#160</a>)</li> <li><a href="https://github.com/micromatch/picomatch/commit/38dffeb16221cc8eb8981524fb6895dd2aaaba76"><code>38dffeb</code></a> chore(deps): pin dependencies (<a href="https://redirect.github.com/micromatch/picomatch/issues/158">#158</a>)</li> <li>Additional commits viewable in <a href="https://github.com/micromatch/picomatch/compare/2.3.1...4.0.4">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-14 20:23:37 -07:00
dependabot[bot]	145dc63fd5	build(deps): bump axios from 1.13.6 to 1.15.0 (#504) ... Bumps [axios](https://github.com/axios/axios) from 1.13.6 to 1.15.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/axios/axios/releases">axios's releases</a>.</em></p> <blockquote> <h2>v1.15.0</h2> <p>This release delivers two critical security patches, adds runtime support for Deno and Bun, and includes significant CI hardening, documentation improvements, and routine dependency updates.</p> <h2>⚠️ Important Changes</h2> <ul> <li><strong>Deprecation:</strong> <code>url.parse()</code> usage has been replaced to address Node.js deprecation warnings. If you are on a recent version of Node.js, this resolves console warnings you may have been seeing. (<strong><a href="https://redirect.github.com/axios/axios/issues/10625">#10625</a></strong>)</li> </ul> <h2>🔒 Security Fixes</h2> <ul> <li><strong>Proxy Handling:</strong> Fixed a <code>no_proxy</code> hostname normalisation bypass that could lead to Server-Side Request Forgery (SSRF). (<strong><a href="https://redirect.github.com/axios/axios/issues/10661">#10661</a></strong>)</li> <li><strong>Header Injection:</strong> Fixed an unrestricted cloud metadata exfiltration vulnerability via a header injection chain. (<strong><a href="https://redirect.github.com/axios/axios/issues/10660">#10660</a></strong>)</li> </ul> <h2>🚀 New Features</h2> <ul> <li><strong>Runtime Support:</strong> Added compatibility checks and documentation for Deno and Bun environments. (<strong><a href="https://redirect.github.com/axios/axios/issues/10652">#10652</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10653">#10653</a></strong>)</li> </ul> <h2>🔧 Maintenance &amp; Chores</h2> <ul> <li><strong>CI Security:</strong> Hardened workflow permissions to least privilege, added the <code>zizmor</code> security scanner, pinned action versions, and gated npm publishing with OIDC and environment protection. (<strong><a href="https://redirect.github.com/axios/axios/issues/10618">#10618</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10619">#10619</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10627">#10627</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10637">#10637</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10666">#10666</a></strong>)</li> <li><strong>Dependencies:</strong> Bumped <code>serialize-javascript</code>, <code>handlebars</code>, <code>picomatch</code>, <code>vite</code>, and <code>denoland/setup-deno</code> to latest versions. Added a 7-day Dependabot cooldown period. (<strong><a href="https://redirect.github.com/axios/axios/issues/10574">#10574</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10572">#10572</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10568">#10568</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10663">#10663</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10664">#10664</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10665">#10665</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10669">#10669</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10670">#10670</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10616">#10616</a></strong>)</li> <li><strong>Documentation:</strong> Unified docs, improved <code>beforeRedirect</code> credential leakage example, clarified <code>withCredentials</code>/<code>withXSRFToken</code> behaviour, HTTP/2 support notes, async/await timeout error handling, header case preservation, and various typo fixes. (<strong><a href="https://redirect.github.com/axios/axios/issues/10649">#10649</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10624">#10624</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/7452">#7452</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/7471">#7471</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10654">#10654</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10644">#10644</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10589">#10589</a></strong>)</li> <li><strong>Housekeeping:</strong> Removed stale files, regenerated lockfile, and updated sponsor scripts and blocks. (<strong><a href="https://redirect.github.com/axios/axios/issues/10584">#10584</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10650">#10650</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10582">#10582</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10640">#10640</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10659">#10659</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10668">#10668</a></strong>)</li> <li><strong>Tests:</strong> Added regression coverage for urlencoded <code>Content-Type</code> casing. (<strong><a href="https://redirect.github.com/axios/axios/issues/10573">#10573</a></strong>)</li> </ul> <h2>🌟 New Contributors</h2> <p>We are thrilled to welcome our new contributors. Thank you for helping improve Axios:</p> <ul> <li><strong><a href="https://github.com/raashish1601"><code>@​raashish1601</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10573">#10573</a></strong>)</li> <li><strong><a href="https://github.com/Kilros0817"><code>@​Kilros0817</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10625">#10625</a></strong>)</li> <li><strong><a href="https://github.com/ashstrc"><code>@​ashstrc</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10624">#10624</a></strong>)</li> <li><strong><a href="https://github.com/Abhi3975"><code>@​Abhi3975</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10589">#10589</a></strong>)</li> <li><strong><a href="https://github.com/theamodhshetty"><code>@​theamodhshetty</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/7452">#7452</a></strong>)</li> </ul> <h2>v1.14.0</h2> <p>This release focuses on compatibility fixes, adapter stability improvements, and test/tooling modernisation.</p> <h2>⚠️ Important Changes</h2> <ul> <li><strong>Breaking Changes:</strong> None identified in this release.</li> <li><strong>Action Required:</strong> If you rely on env-based proxy behaviour or CJS resolution edge-cases, validate your integration after upgrade (notably <code>proxy-from-env</code> v2 alignment and <code>main</code> entry compatibility fix).</li> </ul> <h2>🚀 New Features</h2> <ul> <li><strong>Runtime Features:</strong> No new end-user features were introduced in this release.</li> <li><strong>Test Coverage Expansion:</strong> Added broader smoke/module test coverage for CJS and ESM package usage. (<a href="https://redirect.github.com/axios/axios/pull/7510">#7510</a>)</li> </ul> <h2>🐛 Bug Fixes</h2> <ul> <li><strong>Headers:</strong> Trim trailing CRLF in normalised header values. (<a href="https://redirect.github.com/axios/axios/pull/7456">#7456</a>)</li> <li><strong>HTTP/2:</strong> Close detached HTTP/2 sessions on timeout to avoid lingering sessions. (<a href="https://redirect.github.com/axios/axios/pull/7457">#7457</a>)</li> <li><strong>Fetch Adapter:</strong> Cancel <code>ReadableStream</code> created during request-stream capability probing to prevent async resource leaks. (<a href="https://redirect.github.com/axios/axios/pull/7515">#7515</a>)</li> <li><strong>Proxy Handling:</strong> Fixed env proxy behavior with <code>proxy-from-env</code> v2 usage. (<a href="https://redirect.github.com/axios/axios/pull/7499">#7499</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/axios/axios/blob/v1.x/CHANGELOG.md">axios's changelog</a>.</em></p> <blockquote> <h2>v1.15.0 - April 7, 2026</h2> <p>This release delivers two critical security patches targeting header injection and SSRF via proxy bypass, adds official runtime support for Deno and Bun, and includes significant CI security hardening.</p> <h2>🔒 Security Fixes</h2> <ul> <li> <p><strong>Header Injection (CRLF):</strong> Rejects any header value containing <code>\r</code> or <code>\n</code> characters to block CRLF injection chains that could be used to exfiltrate cloud metadata (IMDS). Behavior change: headers with CR/LF now throw <code>&quot;Invalid character in header content&quot;</code>. (<strong><a href="https://redirect.github.com/axios/axios/issues/10660">#10660</a></strong>)</p> </li> <li> <p><strong>SSRF via <code>no_proxy</code> Bypass:</strong> Introduces a <code>shouldBypassProxy</code> helper that normalises hostnames (strips trailing dots, handles bracketed IPv6) before evaluating <code>no_proxy</code>/<code>NO_PROXY</code> rules, closing a gap that could cause loopback or internal hosts to be inadvertently proxied. (<strong><a href="https://redirect.github.com/axios/axios/issues/10661">#10661</a></strong>)</p> </li> </ul> <h2>🚀 New Features</h2> <ul> <li><strong>Deno &amp; Bun Runtime Support:</strong> Added full smoke test suites for Deno and Bun, with CI workflows that run both runtimes before any release is cut. (<strong><a href="https://redirect.github.com/axios/axios/issues/10652">#10652</a></strong>)</li> </ul> <h2>🐛 Bug Fixes</h2> <ul> <li><strong>Node.js v22 Compatibility:</strong> Replaced deprecated <code>url.parse()</code> calls with the WHATWG <code>URL</code>/<code>URLSearchParams</code> API across examples, sandbox, and tests, eliminating <code>DEP0169</code> deprecation warnings on Node.js v22+. (<strong><a href="https://redirect.github.com/axios/axios/issues/10625">#10625</a></strong>)</li> </ul> <h2>🔧 Maintenance &amp; Chores</h2> <ul> <li> <p><strong>CI Security Hardening:</strong> Added <a href="https://github.com/zizmorcore/zizmor">zizmor</a> GitHub Actions security scanner; switched npm publish to OIDC Trusted Publishing (removing the long-lived <code>NODE_AUTH_TOKEN</code>); pinned all action references to full commit SHAs; narrowed workflow permissions to least privilege; gated the publish step behind a dedicated <code>npm-publish</code> environment; and blocked the sponsor-block workflow from running on forks. (<strong><a href="https://redirect.github.com/axios/axios/issues/10618">#10618</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10619">#10619</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10627">#10627</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10637">#10637</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10641">#10641</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10666">#10666</a></strong>)</p> </li> <li> <p><strong>Docs:</strong> Clarified HTTP/2 support and the unsupported <code>httpVersion</code> option; added documentation for header case preservation; improved the <code>beforeRedirect</code> example to prevent accidental credential leakage. (<strong><a href="https://redirect.github.com/axios/axios/issues/10644">#10644</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10654">#10654</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10624">#10624</a></strong>)</p> </li> <li> <p><strong>Dependencies:</strong> Bumped <code>picomatch</code>, <code>handlebars</code>, <code>serialize-javascript</code>, <code>vite</code> (×3), <code>denoland/setup-deno</code>, and 4 additional dev dependencies to latest versions. (<strong><a href="https://redirect.github.com/axios/axios/issues/10564">#10564</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10565">#10565</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10567">#10567</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10568">#10568</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10572">#10572</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10574">#10574</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10663">#10663</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10664">#10664</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10665">#10665</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10669">#10669</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10670">#10670</a></strong>)</p> </li> </ul> <h2>🌟 New Contributors</h2> <p>We are thrilled to welcome our new contributors. Thank you for helping improve axios:</p> <ul> <li><strong><a href="https://github.com/Kilros0817"><code>@​Kilros0817</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10625">#10625</a></strong>)</li> <li><strong><a href="https://github.com/shaanmajid"><code>@​shaanmajid</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10616">#10616</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10617">#10617</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10618">#10618</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10619">#10619</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10637">#10637</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10641">#10641</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10666">#10666</a></strong>)</li> <li><strong><a href="https://github.com/ashstrc"><code>@​ashstrc</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10624">#10624</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10644">#10644</a></strong>)</li> <li><strong><a href="https://github.com/Abhi3975"><code>@​Abhi3975</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10589">#10589</a></strong>)</li> <li><strong><a href="https://github.com/raashish1601"><code>@​raashish1601</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10573">#10573</a></strong>)</li> </ul> <p><a href="https://github.com/axios/axios/compare/v1.14.0...v1.15.0">Full Changelog</a></p> <hr /> <h2>v1.14.0 - March 27, 2026</h2> <p>This release fixes a security vulnerability in the <code>formidable</code> dependency, resolves a CommonJS compatibility regression, hardens proxy and HTTP/2 handling, and modernises the build and test toolchain.</p> <h2>🔒 Security Fixes</h2> <ul> <li><strong>Formidable Vulnerability:</strong> Upgraded <code>formidable</code> from v2 to v3 to address a reported arbitrary-file vulnerability. Updated test server and assertions to align with the v3 API. (<strong><a href="https://redirect.github.com/axios/axios/issues/7533">#7533</a></strong>)</li> </ul> <h2>🐛 Bug Fixes</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/axios/axios/commit/772a4e54ecc4cc2421e2b746daff0aca10f359d7"><code>772a4e5</code></a> chore(release): prepare release 1.15.0 (<a href="https://redirect.github.com/axios/axios/issues/10671">#10671</a>)</li> <li><a href="https://github.com/axios/axios/commit/4b071371be2f810b4bc7797a13838e0f806ebb22"><code>4b07137</code></a> chore(deps-dev): bump vite from 8.0.0 to 8.0.5 in /tests/smoke/esm (<a href="https://redirect.github.com/axios/axios/issues/10663">#10663</a>)</li> <li><a href="https://github.com/axios/axios/commit/51e57b39db251bfe3d34af5c943dfea18e06c8b6"><code>51e57b3</code></a> chore(deps-dev): bump vite from 8.0.2 to 8.0.5 (<a href="https://redirect.github.com/axios/axios/issues/10664">#10664</a>)</li> <li><a href="https://github.com/axios/axios/commit/fba1a77930f0c459677b729161627234b88c90aa"><code>fba1a77</code></a> chore(deps-dev): bump vite from 8.0.2 to 8.0.5 in /tests/module/esm (<a href="https://redirect.github.com/axios/axios/issues/10665">#10665</a>)</li> <li><a href="https://github.com/axios/axios/commit/0bf6e28eac86e87da2b60bbf5ea4237910e1a08e"><code>0bf6e28</code></a> chore(deps): bump denoland/setup-deno in the github-actions group (<a href="https://redirect.github.com/axios/axios/issues/10669">#10669</a>)</li> <li><a href="https://github.com/axios/axios/commit/8107157c572ee4a54cb28c01ab7f7f3d895ba661"><code>8107157</code></a> chore(deps-dev): bump the development_dependencies group with 4 updates (<a href="https://redirect.github.com/axios/axios/issues/10670">#10670</a>)</li> <li><a href="https://github.com/axios/axios/commit/e66530e3302d56176befd0778155dafea2487542"><code>e66530e</code></a> ci: require npm-publish environment for releases (<a href="https://redirect.github.com/axios/axios/issues/10666">#10666</a>)</li> <li><a href="https://github.com/axios/axios/commit/49f23cbfe4d308a075281c5f798d4c68f648cbe2"><code>49f23cb</code></a> chore(sponsor): update sponsor block (<a href="https://redirect.github.com/axios/axios/issues/10668">#10668</a>)</li> <li><a href="https://github.com/axios/axios/commit/363185461b90b1b78845dc8a99a1f103d9b122a1"><code>3631854</code></a> fix: unrestricted cloud metadata exfiltration via header injection chain (<a href="https://redirect.github.com/axios/axios/issues/10">#10</a>...</li> <li><a href="https://github.com/axios/axios/commit/fb3befb6daac6cad26b2e54094d0f2d9e47f24df"><code>fb3befb</code></a> fix: no_proxy hostname normalization bypass leads to ssrf (<a href="https://redirect.github.com/axios/axios/issues/10661">#10661</a>)</li> <li>Additional commits viewable in <a href="https://github.com/axios/axios/compare/v1.13.6...v1.15.0">compare view</a></li> </ul> </details> <details> <summary>Install script changes</summary> <p>This version modifies <code>prepare</code> script that runs during installation. Review the package contents before updating.</p> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-14 20:23:12 -07:00
dependabot[bot]	c9559c89ee	build(deps): bump next from 16.2.3 to 16.2.6 (#488) ... Bumps [next](https://github.com/vercel/next.js) from 16.2.3 to 16.2.6. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vercel/next.js/releases">next's releases</a>.</em></p> <blockquote> <h2>v16.2.6</h2> <blockquote> <p>[!NOTE] This release contains security fixes and backported bug fixes. It does <strong>not</strong> include all pending features/changes on canary.</p> </blockquote> <h3>Security Fixes</h3> <p>The following advisories have been addressed:</p> <p><strong>High:</strong></p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-8h8q-6873-q5fj">GHSA-8h8q-6873-q5fj: Denial of Service with Server Components</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f">GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-26hh-7cqf-hhc6">GHSA-26hh-7cqf-hhc6: Middleware / Proxy bypass in App Router applications via segment-prefetch routes - <strong>Incomplete Fix Follow-Up</strong></a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-mg66-mrh9-m8jx">GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-492v-c6pp-mqqv">GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-c4j6-fc7j-m34r">GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-36qx-fr4f-26g5">GHSA-36qx-fr4f-26g5: Middleware / Proxy bypass in Pages Router applications using i18n</a></li> </ul> <p><strong>Moderate:</strong></p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-ffhc-5mcf-pf4q">GHSA-ffhc-5mcf-pf4q: Cross-site scripting in App Router applications using CSP nonces</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-gx5p-jg67-6x7h">GHSA-gx5p-jg67-6x7h: Cross-site scripting in beforeInteractive scripts with untrusted input</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-h64f-5h5j-jqjh">GHSA-h64f-5h5j-jqjh: Denial of Service in the Image Optimization API</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-wfc6-r584-vfw7">GHSA-wfc6-r584-vfw7: Cache poisoning in React Server Component responses</a></li> </ul> <p><strong>Low:</strong></p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-vfv6-92ff-j949">GHSA-vfv6-92ff-j949: Cache poisoning via collisions in React Server Component cache-busting</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-3g8h-86w9-wvmq">GHSA-3g8h-86w9-wvmq: Middleware / Proxy redirects can be cache-poisoned</a></li> </ul> <h3>Core Changes</h3> <ul> <li>fix: preserve HTTP access fallbacks during prerender recovery (<a href="https://redirect.github.com/vercel/next.js/issues/92231">#92231</a>)</li> <li>Fix fallback route params case in app-page handler (<a href="https://redirect.github.com/vercel/next.js/issues/91737">#91737</a>)</li> <li>Fix invalid HTML response for route-level RSC requests in deployment adapter (<a href="https://redirect.github.com/vercel/next.js/issues/91541">#91541</a>)</li> <li>Patch setHeader for direct route handlers (<a href="https://redirect.github.com/vercel/next.js/issues/93101">#93101</a>)</li> <li>Include deployment id in <code>cacheHandlers</code> keys (<a href="https://redirect.github.com/vercel/next.js/issues/93453">#93453</a>)</li> <li>Fix double-encoding of URL pathname parts in client param parsing (<a href="https://redirect.github.com/vercel/next.js/issues/93491">#93491</a>)</li> </ul> <h2>v16.2.5</h2> <blockquote> <p>[!NOTE] This release contains security fixes and backported bug fixes. It does <strong>not</strong> include all pending features/changes on canary.</p> </blockquote> <h3>Security Fixes</h3> <p>The following advisories have been addressed:</p> <p><strong>High:</strong></p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-8h8q-6873-q5fj">GHSA-8h8q-6873-q5fj: Denial of Service with Server Components</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f">GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-mg66-mrh9-m8jx">GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-492v-c6pp-mqqv">GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-c4j6-fc7j-m34r">GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vercel/next.js/commit/ee6e79b1792a4d401ddf2480f40a83549fe8e722"><code>ee6e79b</code></a> v16.2.6</li> <li><a href="https://github.com/vercel/next.js/commit/afa053d9eb9c2a68c7eba43e84fe6bed8babcd45"><code>afa053d</code></a> Turbopack: Match proxy matchers with webpack implementation (<a href="https://redirect.github.com/vercel/next.js/issues/93594">#93594</a>)</li> <li><a href="https://github.com/vercel/next.js/commit/97a154e5bbee0cb1ac3fb8aa4db66ac36e796e3d"><code>97a154e</code></a> Turbopack: Fix middleware matcher suffix (<a href="https://redirect.github.com/vercel/next.js/issues/93590">#93590</a>)</li> <li><a href="https://github.com/vercel/next.js/commit/83899bc89103d4df1479e065c7c1e09d4698a7b6"><code>83899bc</code></a> [backport] Disable build caches for production/staging/force-preview deploys ...</li> <li><a href="https://github.com/vercel/next.js/commit/7b222b90954d607fc28a34e9b360a9b1636bc206"><code>7b222b9</code></a> [backport][test] Pin package manager to patch versions (<a href="https://redirect.github.com/vercel/next.js/issues/93595">#93595</a>)</li> <li><a href="https://github.com/vercel/next.js/commit/a8dc24f1fe23d4a22d24fac734837f7c824138f7"><code>a8dc24f</code></a> [backport] Turbopack: more strict vergen setup (<a href="https://redirect.github.com/vercel/next.js/issues/93587">#93587</a>)</li> <li><a href="https://github.com/vercel/next.js/commit/766148f9cd48c0e218acafcd0f15defc14871bf4"><code>766148f</code></a> v16.2.5</li> <li><a href="https://github.com/vercel/next.js/commit/0dd94836a8b43209fcfefa448c141683c22c1a27"><code>0dd9483</code></a> fix: add explicit checks for RSC header (<a href="https://redirect.github.com/vercel/next.js/issues/83">#83</a>) (<a href="https://redirect.github.com/vercel/next.js/issues/98">#98</a>)</li> <li><a href="https://github.com/vercel/next.js/commit/d166096c399c4fc4e09cd2d1bf26dca6579a855d"><code>d166096</code></a> fix proxy matching for segment prefetch URLs (<a href="https://redirect.github.com/vercel/next.js/issues/89">#89</a>) (<a href="https://redirect.github.com/vercel/next.js/issues/96">#96</a>)</li> <li><a href="https://github.com/vercel/next.js/commit/9d50c0b7190f59c470308578e12882788819f14c"><code>9d50c0b</code></a> Strip next-resume header from incoming requests (<a href="https://redirect.github.com/vercel/next.js/issues/92">#92</a>)</li> <li>Additional commits viewable in <a href="https://github.com/vercel/next.js/compare/v16.2.3...v16.2.6">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for next since your current version.</p> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-14 20:22:55 -07:00
Ben Sabic	ac8a20779c	feat(chat): add chat/ai subpath for AI SDK utilities (#492) ... ## Summary Introduces a dedicated `chat/ai` subpath as the home for every Vercel AI SDK helper that ships with Chat SDK. Importing from this subpath keeps the optional `ai` and `zod` peer dependencies out of bundles that don't use them. ### What's new - **`createChatTools`** — exposes Chat SDK operations as ready-to-use AI SDK tools so an agent can read, post, react, edit, delete, and manage thread subscriptions across every adapter the supplied `Chat` instance has registered. - Write operations require user approval by default (`requireApproval: true`); toggle globally or per-tool. - Three presets — `reader`, `messenger`, `moderator` — scope the toolset. - Individual tools can also be cherry-picked (`import { postMessage, addReaction } from "chat/ai"`). - **`toAiMessages`** (and the `Ai*` / `ToAiMessagesOptions` types) now live alongside the tools at `chat/ai`. The previous `chat` re-exports continue to work, but are flagged `@deprecated` with an editor hint pointing to the new home — migration is a one-line import change. - **Docs** — new `/docs/ai` section between Usage and Adapters in the sidebar: - `/docs/ai` — Overview - `/docs/ai/ai-sdk-tools` — `createChatTools` guide - `/docs/ai/to-ai-messages` — `toAiMessages` reference - `/docs/ai/types` — Reference for every type exported from `chat/ai` - **Example app** — `examples/nextjs-chat` now demos the new surface via a "Run Agent Demo" button on the welcome card and a free-form `/agent <prompt>` slash command (streaming, with a placeholder so users get immediate feedback in channel contexts where Slack's typing-status API is a no-op). ### Future plans `createChatTools` currently exposes the cross-adapter Chat SDK surface only. A natural follow-up is to also support **platform-specific tools** — e.g. expose Slack-only `pin`/`unpin`, Discord-only thread archiving, GitHub-only issue commenting, etc., so users can further extend what their agent can do without dropping back to raw adapter calls. The shape would likely be additional opt-in factories under `chat/ai` (or per-adapter subpaths like `@chat-adapter/slack/ai`) that return tools layered on top of the platform-specific adapter clients, while keeping the cross-platform `createChatTools` API as the lowest common denominator. ### Coverage - `createChatTools` orchestrator: 100% statements / 94.7% branches. - Every tool factory's `execute()` is exercised end-to-end (29 tests in `index.test.ts`). - `toAiMessages` keeps its existing 35-test suite covering role mapping, attachment handling, links, transforms, and unsupported-attachment fallbacks. - Tools folder overall: 99.0% statements / 86.1% branches / 97.4% functions / 98.9% lines. --------- Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com> Co-authored-by: dancer <josh@afterima.ge>	2026-05-14 20:13:42 -07:00
josh	b75eedbb5f	feat(chat): add queue-debounce concurrency strategy (#495) ... ## summary adds an opt-in `burst` concurrency strategy for #414 when a thread is idle, the first message waits for `debounceMs`, messages that arrive during that window are queued, and the handler runs once with the latest message plus earlier burst messages in `context.skipped` after the handler finishes, messages that arrived while it was running are drained like `queue`, so the latest queued message is processed with earlier queued messages in `context.skipped` keeps existing `drop`, `queue`, `debounce`, and `concurrent` behavior unchanged updates docs to cover `burst`, explain when to choose it over `debounce`, and document the related `MessageContext` behavior	2026-05-14 19:18:40 -07:00
Hugo	716e934aa2	feat(web-adapter): first class support for Vue and Svelte (#498) ... ## Summary <!-- What does this PR do? --> ## Test plan <!-- How did you verify the changes? --> ## Checklist - [ ] All commits are signed and verified - [ ] `pnpm validate` passes - [ ] Changeset added (or N/A — see [CONTRIBUTING.md](./CONTRIBUTING.md)) - [ ] Documentation updated (or N/A) --------- Co-authored-by: dancer <josh@afterima.ge>	2026-05-14 19:18:24 -07:00
Ben Sabic	2f108bd4b3	feat: rename adapter.client to adapter.octokit / adapter.linearClient / adapter.webClient (#478) ... ## Summary Rename the public native client getter on the GitHub, Linear, and Slack adapters so it matches the underlying SDK class instead of the generic `.client`. The previous `.client` getter is preserved as a `@deprecated` alias on all three adapters, so existing code keeps working without changes. - `bot.getAdapter("github").client` is now `bot.getAdapter("github").octokit` (returns `Octokit`) - `bot.getAdapter("linear").client` is now `bot.getAdapter("linear").linearClient` (returns `LinearClient` from `@linear/sdk`) - `bot.getAdapter("slack").client` is now `bot.getAdapter("slack").webClient` (returns `WebClient` from `@slack/web-api`) Each new getter has TSDoc covering single- vs multi-tenant resolution rules and when calling outside a webhook handler throws. Focused unit tests assert that the new getter returns the underlying SDK instance, that single-tenant calls return the same instance, that the deprecated `.client` alias points at the new getter, that multi-tenant mode without webhook context throws on both getters, and that inside a webhook context the getter resolves to the per-tenant client. Commits are split for review: 1. `feat(adapter-github): rename adapter.client to adapter.octokit` 2. `feat(adapter-linear): rename adapter.client to adapter.linearClient` 3. `docs: use .octokit / .linearClient in chat-sdk.dev examples` 4. `chore: changeset for adapter native client getter rename` 5. `fix: hoist regex literals in new client-getter tests to module scope` 6. `feat(adapter-slack): rename adapter.client to adapter.webClient` 7. `docs: include slack .webClient in chat-sdk.dev examples` 8. `chore: include adapter-slack in native client getter rename changeset` 9. `test(adapter-github,adapter-linear): cover with-context resolution on the new client getters` --------- Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>	2026-05-13 08:35:31 +10:00
Ben Sabic	cd7b6af1c8	test(integration-tests): add Emulate.dev-backed tests for the GitHub adapter (#479) ... ## Summary Add an Emulate.dev-backed integration-test suite for the GitHub adapter, mirroring the structure of the Slack work in #477. Tests drive the adapter against an in-process [`@emulators/github`](https://emulate.dev/docs/github) server and assert on its stateful store (comments, reviews) rather than `mock.calls`, catching wire-format and contract issues that pure Octokit mocks miss. - New private devDeps in `packages/integration-tests`: `@emulators/github`, `@emulators/core`, `@hono/node-server`, plus a workspace dep on `@chat-adapter/github`. (`@emulators/core` and `@hono/node-server` are also declared by #477; this PR is independent of merge order.) - New harness `packages/integration-tests/src/github-emulator-utils.ts` boots the emulator on an ephemeral `127.0.0.1` port, seeds a deterministic user / repo / issue / PR / starter review comment, and exposes a near-passthrough HTTP forwarder. **No re-signing needed** here. `@emulators/core`'s `WebhookDispatcher` already signs deliveries with `X-Hub-Signature-256: sha256=<hex>` exactly as the GitHub adapter expects. The harness also adds a small URL rewriter for Octokit's `pulls.createReplyForReviewComment` shortcut endpoint, translating it into the canonical review-comment POST that the emulator implements. - Four new test files (12 tests), wired to the adapter via its existing `apiUrl` + `webhookSecret` config **zero source changes** to `packages/adapter-github`: - `emulator-github-auth.test.ts` (2) `GET /user` populates `botUserId` during `initialize()`. - `emulator-github-comments.test.ts` (4) `thread.post` / `edit` / `delete` on issue and PR-conversation threads. - `emulator-github-reviews.test.ts` (3) review-comment replies routed through `pulls.createReplyForReviewComment` with the right \`in_reply_to_id\`, plus edit / delete. - `emulator-github-events.test.ts` (3) full inbound `issue_comment` / `pull_request_review_comment` round-trip, including bot self-message filtering. ```mermaid flowchart LR subgraph Test["Vitest test process"] SDK[GitHubAdapter + Chat] Forwarder["HTTP forwarder<br/>passthrough"] Emu["@emulators/github<br/>(in-process Hono)"] end SDK -->|"issues.createComment / pulls.* / GET /user<br/>(apiUrl override)"| Emu Emu -->|"X-Hub-Signature-256 + x-github-event"| Forwarder Forwarder -->|"chat.webhooks.github(request)"| SDK ``` ### Out of scope (deliberate) - **Reactions** `@emulators/github` does not implement the `/reactions` endpoints used by the adapter. Reaction logic is still covered by the existing mock-based tests in `packages/adapter-github/src/index.test.ts`. - **GitHub App auth** (JWT \u2192 installation token via `POST /app/installations/:id/access_tokens`) the adapter and emulator both support it, but PAT-mode was the agreed scope here. - **Multi-tenant install flows** via `installation` webhook events. - Branches/refs, releases, search, actions, checks not used by the adapter. ## Test plan - [x] `pnpm --filter @chat-adapter/integration-tests test` 407 tests pass across 34 files (including the 12 new emulator-github tests, ~480 ms total). - [x] `pnpm check` and `pnpm knip` clean. - [x] CI safety verified: ephemeral ports (`port: 0`), loopback-only binds (`127.0.0.1`), deterministic teardown via `httpServer.close()`, no env vars, no external network egress. ## Checklist - [x] All commits are signed and verified - [x] \`pnpm validate\` passes - [x] Changeset added (or N/A see [CONTRIBUTING.md](./CONTRIBUTING.md)) N/A: \`@chat-adapter/integration-tests\` is \`private: true\` and the change is test-only. - [x] Documentation updated (or N/A) \`packages/integration-tests/README.md\` describes the new emulator-github test category. --------- Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>	2026-05-13 07:12:55 +10:00
Malte Ubl	c889e040e7	defense-in-depth against release.yml running at the wrong time (#494)	2026-05-12 07:21:28 -07:00
Ben Sabic	79227ae991	docs: refresh adapter pages with hand-authored MDX (#474) ... ## Summary Refreshes the adapter docs end-to-end so every adapter — official, vendor-official, and community — now ships hand-authored MDX, lives under a clean URL structure, and renders on a polished sidebar/right-rail layout dedicated to `/adapters` (the shared `/docs` chrome is untouched). ```mermaid flowchart LR subgraph Before direction TB OB[official] --> CB[community<br/>incl. 5 vendor pages] end subgraph After direction TB OA[official] --> VA[vendor-official<br/>5 pages] --> CA[community] end Before -.-> After ``` ### Content & routing - **New `/adapters/vendor-official/<slug>` route** for vendor-maintained adapters (Beeper Matrix, Photon iMessage, Liveblocks, Resend, Zernio). Sidebar gets a third labelled group ("Vendor-Official Adapters") between Official and Community, with a top divider matching the existing Community treatment. - **All 13 vendor-official + community adapters migrated** from runtime README fetching to hand-authored MDX with rich `features:` matrices and full body content (install, quick start, configuration, auth, gateway/streaming, troubleshooting). README fetch stays as a fallback for any future community adapter that hasn't been migrated yet, gated by a new `mdxBody: true` frontmatter flag. - **Messenger filter pages removed** (`/adapters/for/<messenger>` + the "Browse by messenger" chip row on `/adapters`). Existing URLs 308-redirect to `/adapters`. - **Permanent redirects** from `/adapters/community/{matrix,imessage,resend,zernio,liveblocks}` to their new `/adapters/vendor-official/...` paths. - **Fixed** `/docs/adapters` and `/docs/state` so the bare pages are accessible again — the previous catch-all redirect (`:slug*`) was swallowing them. Switched to `:slug+` so subpath URLs still 308 while the bare pages render. ### Visual polish - **Adapter-only sidebar variant** (`AdaptersDocsLayout` + `AdaptersSidebar`) with uppercase eyebrow separators, tighter rows, and a thin themed scrollbar utility class. The shared `/docs` sidebar is untouched. - **Restyled `AdapterHero`**: drops the badges row + packageName, sits the title inline with the logo, larger 17 px tagline, horizontal divider beneath the block. - **Restyled `PackageInstall`** as a tabbed dark single-line snippet with a `$` prompt prefix and a copy button — replaces the previous multi-line `CodeBlock` layout. - **New "Deploy your chat app on Vercel" upsell card** (`<Upsell />`) replaces the old `EditSource / ScrollTop / Feedback / CopyPage` footer cluster on every adapter detail page. - **Listing & messenger pages**: align the H1 to a tighter `text-4xl sm:text-[44px]`, and the section headers to `text-base font-medium tracking-tight` with a one-line muted lede. ### Tooling & tests - Added `mdxBody: true` opt-in to the adapter frontmatter schema (`source.config.ts`), and updated both detail-page handlers (`community/[slug]` and the new `vendor-official/[slug]`) to render the MDX body when present, falling back to README fetch otherwise. - Refactored both detail-page handlers to flatten the body-render branches into a `renderBody()` helper, removing the nested ternaries that were tripping `lint/style/noNestedTernary`. - New test file [`packages/integration-tests/src/docs-adapters.test.ts`](https://github.com/vercel/chat/blob/docs/refresh-adapters/packages/integration-tests/src/docs-adapters.test.ts) — **220 new assertions** covering: - Adapter MDX frontmatter completeness, slug ↔ filename consistency, and `type ∈ {platform, state}`. - Vendor-official invariants: exactly the expected slugs, `vendorOfficial: true`, `community: true`, `author`, `mdxBody: true`, `<FeatureSupport />` rendered. - Community invariants: `community: true` (never vendor-official), `mdxBody: true`, `<FeatureSupport />`. - Official invariants: never flagged, `packageName` always under `@chat-adapter/*`. - `adapters.json` ↔ MDX sync on `packageName` / `type` / `community` / `vendorOfficial`. - Extended `VALID_DOC_PACKAGES` so `docs-content.test.ts` accepts the new vendor-official + community packages, plus `@chat-adapter/web`, `@chat-adapter/web/react`, and `@chat-adapter/messenger`. ### Per-package AGENTS.md - Added `AGENTS.md` to every official adapter and state adapter (14 packages), each tailored to that adapter's surface — overview, directory layout, build/test commands, public exports, thread ID format, webhook flow, authentication, format conversion, cards/streaming, platform quirks, testing approach, coding conventions, and release rules. - Added a one-line `CLAUDE.md` (`@AGENTS.md`) beside each so Claude Code picks up the same instructions through its built-in resolver — same convention as the root. ### Web adapter copy - Cleaned up the Web adapter tagline (removed inline backticks) and dropped the now-redundant "v1 scope" section from the body. --------- Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>	2026-05-12 16:01:19 +10:00
josh	b9b17cd37d	fix(discord): handle interactions in gateway-only mode (#490) ... ## summary fixes #343 fix Discord gateway-only mode so `InteractionCreate` events are handled directly when no interactions endpoint is configured slash commands now defer the gateway interaction and route through the existing slash command handler path, and button interactions defer updates before routing through the existing action handler path also clarifies in the Discord README that Discord sends interactions through either the Gateway or an Interactions Endpoint URL, not both	2026-05-11 22:17:51 -07:00
josh	67c1794a54	docs(chat): clarify direct message routing precedence (#491) ... ## summary clarifies that registered `onDirectMessage` handlers take precedence for incoming DM messages before subscribed-message, mention, and pattern routing updates the direct messages, event handling, thread subscription, and API docs so they match the current runtime behavior adds `onDirectMessage` to the Chat API docs fixes #432	2026-05-12 15:14:57 +10:00
josh	add27309fb	feat(telegram): support typed attachment uploads (#485)	2026-05-11 18:56:42 -07:00
Ben Sabic	fdebde7988	Reapply "feat(slack): expose direct WebClient access via adapter.client" (#472) (#476) ... This reverts commit 2279f1db70. Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>	2026-05-12 08:32:54 +10:00
Ben Sabic	14b1434998	test(integration-tests): add Emulate.dev-backed tests for the Slack adapter (#477) ... * chore(integration-tests): add Emulate.dev Slack emulator devDeps Add @emulators/slack, @emulators/core, and @hono/node-server as devDependencies of the private integration-tests package. These power the upcoming in-process Slack emulator harness used to drive the Slack adapter against a stateful, Slack-shaped HTTP server instead of mocks. * test(integration-tests): add Slack emulator test harness Introduce slack-emulator-utils.ts, a test-only helper that boots the @emulators/slack Hono app on an ephemeral 127.0.0.1 port via @hono/node-server and pre-seeds a deterministic team / channel / bot / human user / OAuth app. The Slack adapter is wired to it via its existing apiUrl config; no source changes required. Also exposes startSlackWebhookForwarder, a tiny in-process Node http forwarder that re-signs the emulator's outbound event_callback deliveries with x-slack-signature / x-slack-request-timestamp before handing them to chat.webhooks.slack(...). The emulator's core WebhookDispatcher only emits GitHub-style X-Hub-Signature-256 headers, so this bridge is what makes inbound flows exercise the SDK's real HMAC verification path. The handle returns direct access to the emulator's Store and WebhookDispatcher so tests can assert on persisted state instead of mock call records. * test(integration-tests): cover Slack auth, postMessage, and reactions via emulator Add three test files that drive the SlackAdapter's outbound WebClient calls through the in-process emulator and assert on its stateful store rather than on mock call records: - emulator-slack-auth.test.ts (3 tests): auth.test populates botUserId during initialize(); explicit botUserId is respected; multi-workspace mode skips the call entirely. - emulator-slack-post-message.test.ts (5 tests): plain text and threaded thread.post round-trip into the messages collection and are visible via conversations.replies; editMessage updates via chat.update; deleteMessage removes via chat.delete; markdown posts succeed. - emulator-slack-reactions.test.ts (3 tests): addReaction / removeReaction round-trip via reactions.add / reactions.remove and show up via reactions.get; multi-user reactions accumulate correctly. These exercise the full HTTP path against a Slack-shaped server, catching wire-format and contract issues that pure mocks miss. * test(integration-tests): cover Slack inbound events and OAuth v2 install via emulator Add two test files that drive end-to-end flows previously only verifiable against real Slack: - emulator-slack-events.test.ts (4 tests): a human posts to the emulator, which dispatches an event_callback to the local forwarder, which signs the body and hands it to chat.webhooks.slack(...). The SDK's onNewMention and onNewMessage handlers run with a live Thread and the bot's reply lands back in the emulator. Bot self-messages are correctly filtered. This is the only Slack adapter test in the repo that covers the full inbound-then-outbound round-trip without hand-crafted webhook payloads. - emulator-slack-oauth.test.ts (4 tests): handleOAuthCallback exchanges a real authorization code via oauth.v2.access against the emulator's authorize/callback flow; the resulting installation is persisted in the state adapter; invalid codes and mismatched client_secrets are rejected; the freshly issued bot token works for subsequent chat.postMessage calls via withBotToken. * docs(integration-tests): document emulator-* test category Add an "Emulator tests" entry to the package README so newcomers can distinguish the new emulator-backed suite from the existing unit and replay tests, and find the harness in slack-emulator-utils.ts. * fix(integration-tests): keep full token scopes after emulator.reset() `applyTokenSeed` (used during `reset()`) was granting only ["chat:write", "channels:read"] to seeded tokens, while the initial `createCoreServer({ tokens })` call granted the full bot/human scope sets. After the first `reset()` the bot token silently lost `channels:history`, `users:read`, `reactions:read`, and `reactions:write`, which would surface as flaky behaviour for any test that relied on those scopes after a reset. Unify both call sites on a single `buildTokenSeedEntries` helper so fresh-boot and post-reset state always grant the same scopes. Add a regression test in emulator-slack-auth.test.ts that triggers a manual `emulator.reset()` and re-asserts that the bot token still resolves via auth.test. * refactor(integration-tests): reorganize Slack emulator tests under emulator/slack/ Address review feedback (visyat) by moving the flat `emulator-slack-*.test.ts` files into a per-adapter directory: packages/integration-tests/src/emulator/slack/ utils.ts auth.test.ts events.test.ts oauth.test.ts post-message.test.ts reactions.test.ts This scales cleanly as more adapter emulator suites land (e.g. `emulator/github/`), instead of cluttering the top-level src tree with adapter-prefixed file names. Also hoist the duplicated `silentLogger` definition from each test file into the shared `utils.ts`, removing five identical copies. No behavior changes. All 20 emulator tests still pass. * test(integration-tests): cover Slack multi-workspace token resolution via emulator Add `emulator/slack/multi-workspace.test.ts` exercising the path that was previously only covered by replay/mock-based tests: the adapter runs without a hardcoded `botToken`, multiple workspaces are persisted in the state adapter via `adapter.setInstallation(teamId, ...)`, and inbound `event_callback`s for either team are routed to the correct per-tenant bot token end-to-end against the shared emulator. To make this work, the helper grew two small additions: - `addEmulatorWorkspace(emulator, seed)` — register an additional team + bot + channel + token on an already-booted emulator, so two tenants live side-by-side without needing two emulator instances. - The inbound forwarder's `augmentEventEnvelope` now accepts an optional `resolveTeamId(envelope)` callback, defaulting to a constant teamId for the existing single-workspace tests. The multi-workspace test passes a resolver that looks up the dispatched event's channel in the emulator store and returns the owning team's id, so the SDK's per-team token resolver sees the right `team_id` on the envelope. Three new tests: team-A routing, team-B routing, and `getInstallation` returning null for unknown team ids. Follow-up from review feedback on PR #477. --------- Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>	2026-05-12 08:29:02 +10:00
dependabot[bot]	41139a42ff	build(deps): bump mermaid from 11.12.2 to 11.15.0 (#486) ... Bumps [mermaid](https://github.com/mermaid-js/mermaid) from 11.12.2 to 11.15.0. - [Release notes](https://github.com/mermaid-js/mermaid/releases) - [Commits](https://github.com/mermaid-js/mermaid/compare/mermaid@11.12.2...mermaid@11.15.0) --- updated-dependencies: - dependency-name: mermaid dependency-version: 11.15.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-12 08:04:39 +10:00
Ilya	711babe06d	fix(adapter-telegram): handle video_note (round video messages) in extractAttachments (#457) ... * fix(adapter-telegram): handle video_note in extractAttachments Round video messages (video_note) were silently dropped because extractAttachments had no branch for them. Adds the video_note field to TelegramMessage and extracts it as a "video" attachment with width/height set to the clip's length. Fixes #456 * test(adapter-telegram): add video_note attachment extraction test	2026-05-11 09:15:01 -07:00
Felix Arntz	06fb8e59ef	chore: set up konsistent with basic initial config for package, adapter, and state adapter conventions (#466) ... * set up konsistent with basic initial config * add konsistent to CI * fix konsistent.json formatting * fix(gchat): move GoogleChatAdapterConfig to ./types for konsistent * fix(slack): move SlackAdapterConfig to ./types and drop Partial wrapper from createSlackAdapter * fix(messenger): name createMessengerAdapter parameter MessengerAdapterConfig * fix(web): rename WebAdapterOptions to WebAdapterConfig and import Adapter type in index.ts * fix(whatsapp): align WhatsAppAdapterConfig and creator with konsistent + map kebab to PascalCase * fix(state-memory): add MemoryStateAdapterOptions type for konsistent * fix(state-ioredis): unify URL and client options under IoRedisStateAdapterOptions * fix(state-redis): unify URL and client options under RedisStateAdapterOptions * fix(state-pg): unify URL and client options under PostgresStateAdapterOptions * chore: changeset for konsistent convention alignment * chore: drop CHANGELOG.md from konsistent's required files list CHANGELOG.md is generated automatically by changesets on each release — it's never hand-authored and doesn't exist for a package until its first release lands. Requiring it as a convention check makes CI fail indefinitely for any newly added package, with no honest fix available (an empty placeholder is just noise that gets overwritten on first release). * docs: document konsistent and package shape conventions * fix(web): use WebAdapterConfig in WebAdapter field types after main merge The merge of main into konsistent brought in PR #475's `protected` field modifiers on top of the WebAdapterOptions → WebAdapterConfig rename, leaving two stale references to the (un-imported) old name. Switch them to WebAdapterConfig and update a stale JSDoc reference in als.ts to match. --------- Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com> Co-authored-by: Ben Sabic <27636870+bensabic@users.noreply.github.com>	2026-05-11 19:29:05 +10:00
Felix Arntz	e60bc8c408	chore: add .nvmrc file, formally specify Node version range support, and cover more versions in CI (#465) ... * add .nvmrc file * follow up * make support of Node >= 20 explicit * update default Node version for contributing to the repo to 24 * run build-and-test CI job for both Node 20 and 24 * add changeset for package.json change	2026-05-11 19:28:34 +10:00
Ben Sabic	3347bfbcda	chore: remove .vercel.approvers files (#483) ... Code ownership is already governed by .github/CODEOWNERS. Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>	2026-05-11 12:36:36 +10:00
Ben Sabic	788639ba5d	ci: promote release branch on successful publish (#482) ... Pushes the published commit to the `release` branch so Vercel projects configured with `release` as their production branch (docs, example app) only deploy after a successful `changeset publish`. Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>	2026-05-11 12:06:19 +10:00
Salman Shaikh	2ffed48bea	feat: make adapter internals protected to enable subclassing (#475) ... * chore: changed class function access to protected * chore: format * chore: added changeset * chore(changeset): drop unchanged shared package, expand description * refactor(adapters): keep internal state private, only protected for extension surface Narrow scope of #475: caches, polling/runtime state, and one-shot warning flags stay private. Methods and shared helpers (logger, formatConverter, chat, config) remain protected as the documented extension surface. Also fixes a typecheck failure where gchat's oauth2Client (now private) no longer requires a portable type for the emitted .d.ts. * test(adapters): add subclass extensibility tests Each adapter now has a compile-time test that subclasses can access the documented protected surface. If any of these members revert to private, the test file fails to type-check. * style: apply ultracite formatting to subclass tests * style(slack): mark static cache TTL constants as readonly These three protected static cache TTLs are configuration constants, not mutable state. Marking them readonly prevents subclasses (the new extension surface from this PR) from mutating values shared across every instance in-process. * test(adapters): document intent of subclass extensibility tests Mirrors the inline comment from the Telegram subclass test across the other nine adapter tests so future readers immediately understand these blocks are type-only sentinels — they fail at typecheck (not vitest) if a member reverts to private. * docs(adapters): document subclassing for adapter customization Adds a "Customizing an adapter via subclassing" section to the Adapters page that walks through extending an official adapter to override a protected hook (using the issue #433 Telegram processUpdate scenario as the canonical example) and clarifies that private members are intentionally off-limits. * refactor(linear): expose accessTokenExpiry to subclasses The surrounding refreshClientCredentialsToken and ensureValidToken methods are now protected, but accessTokenExpiry was kept private — meaning a subclass overriding either method couldn't read or update the expiry without calling super. Flipping it to protected lets subclasses fully reimplement the token-refresh flow. * chore(changeset): bump adapters from patch to minor This PR adds a new, additive capability — subclassing official adapters to override protected hooks. Per CONTRIBUTING.md, additive backward-compatible features warrant a minor bump rather than a patch. * docs(adapters): clarify subclassing surface stability Correct the parenthetical describing what stays `private` (credentials are now `protected`) and add a callout warning that the `protected` extension surface is intentionally broader than the public API but not yet fully stable, so subclass authors know to pin versions and prefer overriding the smallest hook. --------- Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>	2026-05-10 20:44:41 +10:00
Ben Sabic	d2ec28c447	chore: Add Messenger logo to homepage (#473) ... * chore: Add Messenger logo to homepage * chore: Use Messenger brand colour for logo --------- Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>	2026-05-09 19:41:53 +10:00
Vishal Yathish	2279f1db70	Revert "feat(slack): expose direct WebClient access via adapter.client" (#472) ... * Revert "feat(slack): expose direct WebClient access via adapter.client (#471)" This reverts commit 8366b8b0fb. * Fix: The `createSlackAdapter()` helper function silently drops the `apiUrl` config field, so custom Slack API URLs (e.g., for GovSlack) are ignored when using the helper. This commit fixes the issue reported at packages/adapter-slack/src/index.ts:5055 **Bug explanation:** The `SlackAdapterConfig` interface defines an `apiUrl` field (line 166) that allows users to override the Slack Web API base URL — useful for GovSlack or self-hosted gateways. The `SlackAdapter` constructor reads this field at line 622: ```typescript const slackApiUrl = config.apiUrl ?? process.env.SLACK_API_URL; ``` However, the `createSlackAdapter()` helper function (around line 5055) constructs a `resolved` config object that includes many fields from the user's config but omits `apiUrl`. This means when a user writes: ```typescript createSlackAdapter({ apiUrl: "https://slack-gov.com/api/" }) ``` The `apiUrl` is silently dropped and the `WebClient` is created without the custom URL. The `SLACK_API_URL` environment variable fallback still works (since it's checked in the constructor), but explicit config via the helper is lost. This is clearly a bug — all other config fields are forwarded through the `resolved` object, and `apiUrl` was simply forgotten. **Fix explanation:** Added `apiUrl: config?.apiUrl,` to the `resolved` config object in `createSlackAdapter()`. This ensures the `apiUrl` value from user config is properly forwarded to the `SlackAdapter` constructor, matching the pattern used for all other optional config fields. Co-authored-by: Vercel <vercel[bot]@users.noreply.github.com> Co-authored-by: visyat <vishal.yathish@gmail.com> --------- Co-authored-by: vercel[bot] <35613825+vercel[bot]@users.noreply.github.com> Co-authored-by: Vercel <vercel[bot]@users.noreply.github.com>	2026-05-09 02:21:33 -07:00
Ben Sabic	8366b8b0fb	feat(slack): expose direct WebClient access via adapter.client (#471) ... * feat(slack): expose direct WebClient access via adapter.client Mirror the Linear and GitHub adapter pattern by exposing the underlying @slack/web-api WebClient as `adapter.client` for any Web API call not covered by the SDK's high-level methods. Resolution order: 1. Token from the current request context (multi-workspace webhooks, `withBotToken()`). 2. The default `botToken` when configured as a static string or a synchronous resolver function. Throws AuthenticationError outside of any context in multi-workspace mode, or when `botToken` is configured as an async resolver. For both, bind the token explicitly with `adapter.withBotToken(token, () => ...)`. Internally, the existing private `client` field is renamed to `_client` so the public getter can return per-token cached `WebClient` instances. All internal API calls continue to route through `_client.foo(await this.withToken(...))` unchanged. Also fixes `createSlackAdapter()` silently dropping the `apiUrl` config field, surfaced by the new apiUrl-propagation test. * docs(slack): document direct WebClient access Add Slack to the "Direct client access" section of the chat-sdk.dev docs (api/chat.mdx, usage.mdx) alongside Linear and GitHub. Update the multi-tenant Callout to spell out both Slack constraints — request context required in multi-workspace mode, and `withBotToken()` required when `botToken` is an async resolver. Add a parallel "Direct WebClient access" section to the Slack adapter README with a usage example, the token resolution order, and the async-resolver workaround. * feat(example): add Channel Info button using slack.client Demonstrate the new direct WebClient access pattern in the nextjs-chat demo with a "Channel Info (Slack)" button. The handler resolves the Slack adapter from the action event, reaches into `adapter.client.conversations.info` (channels:read scope, already in the example manifest), and renders the result as a Card with channel name, member count, topic, purpose, and the standard flags. Falls back to a friendly message on non-Slack platforms. * feat(example): add Pin Message button using slack.client.pins.add Pin the welcome card itself via `adapter.client.pins.add({ channel, timestamp: event.messageId })` to demonstrate calling a Slack Web API endpoint not wrapped by the SDK. Adds the required `pins:write` scope to the example Slack manifest. * chore(example): render channel info as a table and include num_members Replace the Fields/Section layout in the Channel Info card with a two-column Table for a tidier presentation, and pass `include_num_members: true` so the Members row is actually populated (Slack's `conversations.info` omits it by default). * test(slack): expand coverage for adapter.client Adds three tests: - Cache differentiation: distinct tokens produce distinct WebClient instances so per-workspace credentials never bleed across calls. - apiUrl env var resolution: SLACK_API_URL is honored by the WebClient the new getter returns (covers GovSlack-style deployments). - End-to-end multi-workspace token routing: a real block_actions webhook drives `processAction`, and the handler-side `event.adapter.client.token` matches the installation's bot token — proving the request-context-bound client works inside webhook dispatch. --------- Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>	2026-05-09 18:59:39 +10:00
Ben Sabic	0adf3adef6	feat(tests): add @chat-adapter/tests test kit (#470) ... * feat(tests): add @chat-adapter/tests test kit New package providing Vitest factories, custom matchers, and a setup file for people building Chat SDK adapters and bots. Factories: createMockAdapter, createMockChatInstance, createMockState (with working in-memory subscriptions/locks/KV/queues), createTestMessage, mockLogger / createMockLogger. Matchers: toHavePosted(threadId, textPattern?), toHaveDispatched(handler), toBeSubscribedTo(threadId). Auto-register via the '@chat-adapter/tests/setup' subpath in vitest setupFiles. chat and vitest are peer dependencies. Adapter-specific helpers (e.g. signed Slack webhook builders) belong in each adapter's own /testing subpath, not in this kit. * test(integration-tests): allow @chat-adapter/tests imports in README check * docs: add Testing page covering @chat-adapter/tests New content/docs/testing.mdx walks bot authors and custom-adapter authors through the kit's factories, custom matchers, and setup file. Added under the Usage section in the sidebar, after error-handling. Cross-link from contributing/testing.mdx clarifying that the hand-rolled patterns there are for repo contributors building first-party adapters, while consumers of Chat SDK should use @chat-adapter/tests. * test(integration-tests): allow @chat-adapter/tests imports in docs check * fix(tests): match real Adapter.postMessage signature in toHavePosted Adapter.postMessage is (threadId: string, message: AdapterPostableMessage) — previously the matcher read args[0] as { id: string } and args[1] as { text: string }, neither of which match the actual SDK shape. The matcher's own tests fed the same wrong shape into the mock so they passed locally while the matcher silently failed against any real bot or adapter. Now compares args[0] as a string threadId, and extracts a comparable string from AdapterPostableMessage's union — strings directly, PostableMarkdown .markdown, PostableRaw.raw, and PostableCard.fallbackText. PostableAst and fallback-less cards aren't text-matchable; documented in the JSDoc. Tests updated to call postMessage with the real signature and to cover each comparable AdapterPostableMessage shape. * test(tests): add smoke tests driving matchers against a real Chat Construct a real `Chat` with a `createMockAdapter` + `createMockState` and exercise `Chat.thread().post()` and `.subscribe()` end-to-end. The matchers (toHavePosted, toBeSubscribedTo) then assert against the actual call shape the SDK uses, so a future signature drift breaks here instead of silently agreeing with whatever wrong shape lives in the unit tests. This is the regression guard for the postMessage-shape bug fixed in the prior commit: each new matcher in subsequent PRs should be paired with a smoke case here. * feat(tests): round out adapter mutation matchers Adds toHaveEdited, toHaveDeleted, toHaveReactedWith, toHaveStartedTyping, and toHavePostedToChannel — covering the common Adapter mutation surface that bot authors assert on. Each matcher's signature was checked against packages/chat/src/types.ts, and each is paired with a smoke case that drives a real Chat through the corresponding Thread/Channel API so signature drift breaks the smoke test instead of silently agreeing with the unit tests. Emoji matching accepts both plain strings and EmojiValue ({ name }). Text matching reuses the same extraction rules as toHavePosted — strings, PostableMarkdown.markdown, PostableRaw.raw, and PostableCard.fallbackText. Documented in matcher JSDoc, README, and the Testing docs page. --------- Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>	2026-05-09 14:17:36 +10:00
Vishal Yathish	c46fdb6b34	[slack] add support for external installation providers for bot token management (#467) ... * [slack] add support for external installation providers for bot token management * changeset * fix(slack): correct stale 'Connex' comment to 'Vercel Connect' * docs(slack): expand changeset with provider details and Enterprise Grid notes * docs(slack): document installationProvider and Enterprise Grid lookup keys * test(slack): cover installationProvider for interactive payloads on both install types * fix(slack): route rehydrateAttachment through installationProvider --------- Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>	2026-05-09 11:11:06 +10:00
Dima Voytenko	0f0c203165	fix(slack): prefer webhookVerifier over signingSecret (#468) ... * fix(slack): prefer webhookVerifier over signingSecret and SLACK_SIGNING_SECRET When `webhookVerifier` is configured, ignore both `config.signingSecret` and the `SLACK_SIGNING_SECRET` env var. Previously a configured `signingSecret` (or env var) would shadow the verifier the caller wired up, which is the opposite of the intended override behavior. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * docs(slack): update README to match new webhookVerifier precedence Mirror the JSDoc/changeset wording: webhookVerifier wins over both signingSecret and SLACK_SIGNING_SECRET. The previous note still claimed signingSecret won, contradicting the behavior fixed in e77359b. --------- Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com> Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>	2026-05-09 10:34:24 +10:00
github-actions[bot]	5edcbbf7ef	chore(release): version packages (#464) ... Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> @chat-adapter/web@4.28.1 @chat-adapter/messenger@4.28.1	2026-05-08 04:09:48 -07:00
github-actions[bot]	b3fc64d34e	chore(release): version packages (#442) ... Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-05-08 04:01:03 -07:00
josh	0cc3d06fd4	docs: fix stale API examples, adapter matrix, and broken links (#463) ... * 1 * 2 * cs * 3	2026-05-08 03:58:08 -07:00
Ben Sabic	2de905cb0c	fix: regenerate pnpm-lock.yaml after merge conflict (#462) ... Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>	2026-05-08 17:40:23 +10:00
josh	c1cd9b5da1	feat(chat): add callbackUrl to buttons and modals (#454) ... * 1 * wfw * 4224 * dfe * wip * f * 22 * tsts * more * ch * dc * t * tm * docs * ex * k * cs * lock * test(chat): expand callbackUrl coverage * docs: document callbackUrl handling for adapter authors * docs: expand changeset for callbackUrl feature * docs(skill): mention callbackUrl on Button and Modal * feat(example): add modal callbackUrl workflow demo * test(integration): add replay tests for callbackUrl flows --------- Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>	2026-05-08 17:26:18 +10:00
Vishal Yathish	68025ca965	[messenger] add messenger (meta) platform adapter to chat sdk (#461) ... * [messenger] add messenger (meta) platform adapter to chat sdk - Webhook handling with HMAC-SHA256 signature verification - Generic and Button template support for cards - Postback, reaction, delivery/read confirmation handling - Message caching for fetchMessages (Messenger has no history API) - Replay tests and ~98% code coverage Co-authored-by: Dimitar K. Nikolov <mitkodkn@users.noreply.github.com> Co-authored-by: Ben Sabic <27636870+bensabic@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com> * Fix: The `@chat-adapter/messenger` package version is `4.15.0` while all other packages in the Changesets fixed version group are at `4.27.0`, breaking the fixed versioning contract. This commit fixes the issue reported at packages/adapter-messenger/package.json:3 **Bug explanation:** The repository uses Changesets with a `"fixed"` configuration: `[["chat", "@chat-adapter/*"]]`. This means all packages matching these patterns must always share the same version number. Every package in the group (`chat`, `@chat-adapter/discord`, `@chat-adapter/gchat`, `@chat-adapter/github`, `@chat-adapter/linear`, `@chat-adapter/shared`, `@chat-adapter/slack`, `@chat-adapter/teams`, `@chat-adapter/telegram`, `@chat-adapter/web`, `@chat-adapter/whatsapp`, and the state packages) is at version `4.27.0`, except `@chat-adapter/messenger` which is at `4.15.0`. This is likely because the messenger adapter was newly added to the monorepo (copied from a template or created fresh) and its version was never aligned with the rest of the fixed group. This mismatch will cause problems with the Changesets release workflow — when Changesets tries to bump versions for the fixed group, it may produce inconsistent or errored releases because one package is 12 minor versions behind the others. **Fix explanation:** Changed `"version": "4.15.0"` to `"version": "4.27.0"` in `packages/adapter-messenger/package.json` to align it with all other packages in the fixed version group. Co-authored-by: Vercel <vercel[bot]@users.noreply.github.com> Co-authored-by: visyat <vishal.yathish@gmail.com> * Fix: Messenger adapter env var guard only checks `FACEBOOK_APP_SECRET` but `createMessengerAdapter` requires all three env vars, causing a `ValidationError` crash at Next.js build time when only `FACEBOOK_APP_SECRET` is set. This commit fixes the issue reported at examples/nextjs-chat/src/lib/adapters.ts:154 **Bug Analysis:** The build failure is confirmed in the Vercel build log with: ``` Error [ValidationError]: pageAccessToken is required. Set FACEBOOK_PAGE_ACCESS_TOKEN or provide it in config. ``` The root cause is in `examples/nextjs-chat/src/lib/adapters.ts` at line ~154. The messenger adapter guard only checks for `FACEBOOK_APP_SECRET`: ```typescript if (process.env.FACEBOOK_APP_SECRET) { ``` However, `createMessengerAdapter` (in `packages/adapter-messenger/src/index.ts`) validates and throws `ValidationError` for each of three required env vars: `FACEBOOK_APP_SECRET`, `FACEBOOK_PAGE_ACCESS_TOKEN`, and `FACEBOOK_VERIFY_TOKEN`. When only `FACEBOOK_APP_SECRET` is set in the Vercel project environment, the guard passes, `createMessengerAdapter` is called, and it throws a `ValidationError` for the missing `FACEBOOK_PAGE_ACCESS_TOKEN`. Since this code runs at module evaluation time during the Next.js build's "Collecting page data" phase, the uncaught error crashes the entire build. This is inconsistent with other adapters in the same file. For example, the WhatsApp adapter checks both `WHATSAPP_ACCESS_TOKEN` and `WHATSAPP_PHONE_NUMBER_ID`, and the gchat/github/linear/whatsapp adapters all wrap creation in try-catch blocks. **Fix:** 1. Updated the env var guard to check all three required environment variables (`FACEBOOK_APP_SECRET`, `FACEBOOK_PAGE_ACCESS_TOKEN`, and `FACEBOOK_VERIFY_TOKEN`) before attempting to create the adapter. 2. Wrapped the `createMessengerAdapter` call in a try-catch block (matching the pattern used by gchat, github, linear, and whatsapp adapters) so that any unexpected validation errors are caught and logged as warnings instead of crashing the build. Co-authored-by: Vercel <vercel[bot]@users.noreply.github.com> Co-authored-by: visyat <vishal.yathish@gmail.com> --------- Co-authored-by: Dimitar K. Nikolov <mitkodkn@users.noreply.github.com> Co-authored-by: Ben Sabic <27636870+bensabic@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: vercel[bot] <35613825+vercel[bot]@users.noreply.github.com> Co-authored-by: Vercel <vercel[bot]@users.noreply.github.com>	2026-05-08 17:25:54 +10:00
Ben Sabic	e48d8cec8f	ci: pin GitHub Actions to commit SHAs (#460) ... Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>	2026-05-07 18:50:16 -07:00
josh	eb5f94a8ee	feat(chat): add message.subject and adapter client access (#459) ... * 1 * w * 3f * x * ln * gh * sl * t1 * u * t2 * t3 * t4 * t5 * d * d2 * cs * fx * cl * docs: clean up subject + .client docs and restructure nav - subject.mdx: simplify prose, drop redundant platform lists, link to MessageSubject API and getAdapter - api/message.mdx: add MessageSubject TypeTable - api/chat.mdx: expand getAdapter with Direct client access content - adapters.mdx: add Parent subject and Native client rows to feature matrix - usage.mdx: mention .client under Accessing adapters - adapter-github/-linear READMEs: add Direct API client section - meta.json: split Features into Messaging + Interactivity, move error-handling to Usage - title case across messaging-cluster page titles --------- Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>	2026-05-08 10:51:53 +10:00
Max	36864dae41	fix(docs): scroll code blocks in adapter READMEs (#453) ... * fix(docs): scroll code blocks in adapter READMEs * fix(docs): preserve right padding on scroll-end	2026-05-06 09:51:12 -07:00
Max	3cfb77fa50	feat(docs): render GFM alerts as Callout (#452)	2026-05-06 09:49:38 -07:00
dependabot[bot]	3e4764db4d	build(deps-dev): bump postcss from 8.5.10 to 8.5.11 (#451) ... Bumps [postcss](https://github.com/postcss/postcss) from 8.5.10 to 8.5.11. - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/postcss/postcss/compare/8.5.10...8.5.11) --- updated-dependencies: - dependency-name: postcss dependency-version: 8.5.11 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-05 17:33:20 -07:00
Ben Sabic	3490a8c84c	feat: add @chat-adapter/web — browser chat UI for chat-sdk bots (#444) ... * feat(chat): expose awaitable Promise from processMessage Return the inner task as Promise<void> instead of void so streaming adapters can await full handler completion and surface user-handler rejections at the wire level. waitUntil semantics for existing webhook adapters are unchanged — the SDK still tracks the work with errors swallowed (and logged) so platforms don't retry on handler bugs. Required by @chat-adapter/web, whose response body is the user handler's stream. * feat(adapter-web): add @chat-adapter/web package A new platform adapter that lets a chat-sdk bot serve a browser chat UI alongside Slack/Teams/Discord/etc. without writing any client-side glue. Speaks the AI SDK UI message stream protocol, so @ai-sdk/react's useChat and the ai-elements component library work out of the box. - `@chat-adapter/web` — server: createWebAdapter({ userName, getUser }) - `@chat-adapter/web/react` — client: useChat() preconfigured with DefaultChatTransport against /api/chat (override via `api`) Defaults that matter for v1: - `isDM: true` — every web message routes through onDirectMessage - `persistMessageHistory: true` — chat-sdk caches each turn in the configured state adapter so handlers can read prior context via thread.messages / channel.messages (no platform history API exists) - channelId === threadId — web has no separate channel concept; this prevents cross-conversation bleed when a single user has multiple useChat sessions - Native `adapter.stream` implementation pumps text-deltas straight onto the SSE response — no post+edit fallback Out of scope for v1: cards/JSX rendering, reactions, modals, file uploads, edit/delete, multi-tab proactive push. * feat(example-nextjs-chat): wire up web adapter and add /chat page - Register the web adapter in lib/adapters.ts with a demo getUser (single shared identity — replace with NextAuth/Clerk/cookie auth in production) - Expose POST /api/chat backed by bot.webhooks.web (using next/after for waitUntil) - Add a minimal /chat page using @chat-adapter/web/react's useChat — same bot.onDirectMessage handler that powers Slack now powers the browser too Bumps `ai` to ^6.0.174 to align with @ai-sdk/react@^3 (avoids dual provider-utils versions in the workspace). * docs: list @chat-adapter/web in registry - Add an entry to adapters.json so the package shows up on /adapters - Add a globe SVG to lib/logos.tsx and wire it into the icon map - Mention the new adapter in docs/adapters.mdx * feat(adapter-web): tighten request handling and message construction - Reject user ids containing ':' with HTTP 400 — the character would corrupt the thread-id round-trip through decodeThreadId - Skip emitting text-start/text-end in postMessage when the resolved text is empty so useChat doesn't render blank assistant bubbles - Derive the parseMessage author from raw.role so rehydrated assistant messages report the bot identity instead of "unknown" - Drop the duplicate handler-error log; chat.processMessage already logs at ERROR level - Document the actual persistMessageHistory default (true) and the state-cache rationale; promote the fetchMessages no-op rationale into its JSDoc * test(adapter-web): add direct coverage for stream() - Aborting request.signal mid-stream short-circuits the iterator and still writes text-end via the finally block - Non-text StreamChunks (task_update, plan_update) are dropped without emitting any delta - The SentMessage returned from thread.post matches the id used in text-start / text-end events * docs(adapter-web): expand README into the full adapter docs page The docs site renders each adapter's README, so flesh out @chat-adapter/web to match the depth of @chat-adapter/slack: authentication boundary, threading semantics, streaming, persistence, React hook reference, configuration table, feature matrix, and troubleshooting. * docs(adapter-web): drop unsupported provider import from streaming example * fix(adapter-web): validate conversationId for reserved colon character * fix(example): show error state in web chat demo * fix(example): add thinking indicator to web chat demo * feat(example): redesign web chat demo with tailwind * chore: remove redundant changeset --------- Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com> Co-authored-by: dancer <josh@afterima.ge>	2026-05-05 15:55:40 -07:00
Ben Sabic	d7999aba26	chore: add Vercel Code Approvers files mirroring CODEOWNERS (#450) ... Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>	2026-05-05 15:47:48 -07:00