skills/vercel__chat
1
0
Fork 0
mirror of https://github.com/vercel/chat.git synced 2026-09-14 18:32:29 +08:00
Code Issues Packages Projects Releases Wiki Activity
Files
changeset-release/main
vercel__chat/packages/adapter-shared/CHANGELOG.md
T
github-actions[bot] 21c88d7c0f chore(release): version packages
2026-09-09 17:54:32 +00:00

12 KiB
Raw Permalink Blame History

@chat-adapter/shared

4.41.0

Patch Changes

  • 6adca36: Enforce the guarded download deadline inside downloadAttachment itself, for both the wait for response headers and the body read. A late response is destroyed, so the timeout holds even when a custom transport ignores the supplied signal.
  • Updated dependencies [2e2426d]
  • Updated dependencies [056d883]

4.40.0

Patch Changes

4.39.0

Minor Changes

  • 153bd96: guard Messenger attachment downloads against SSRF and oversized responses

    downloadAttachment in @chat-adapter/shared accepts an optional hosts allowlist that restricts downloads, including redirect targets, to the given hosts and their subdomains. The Messenger adapter uses it to download attachment media only from Meta's fbsbx.com and fbcdn.net hosts, with the shared SSRF guard, 25 MB size cap, and 30 second timeout. External fallback and link-share URLs are rejected before any network request.

  • bb92688: secure anonymous attachment downloads against SSRF and oversized responses

    @chat-adapter/shared gains downloadAttachment, a guarded downloader that refuses private and internal addresses (as URL literals, through DNS resolution, and after redirects), decodes compressed responses, caps the body size at 25 MB, and bounds the whole download with a 30 second timeout. All of these are configurable, including the transport for proxied deployments.

    The Teams adapter uses it for anonymous attachment downloads. HTTPS attachments on any public host keep working, plain-HTTP URLs are refused, and the Bot Framework Emulator's loopback connector now uses bot authentication so local development keeps working.

  • e71bfea: Add normalizeCodeFences to @chat-adapter/shared: a code-fence normalizer for platforms whose triple-backtick fences treat the text after the opening fence as code rather than a CommonMark info string. Only paired fences become code blocks (unpaired fences, fences inside inline code, and fences on quoted lines stay literal text), text following a closing fence cannot be promoted to a block construct, and per-segment callbacks keep text-level rewrites out of code content.

    The WhatsApp adapter now uses it when parsing incoming messages: the first line of a code block is preserved in message text and formatted content, and bold/strikethrough rewriting no longer corrupts fenced code.

  • b6fa24c: guard attachment downloads across the remaining adapters

    Slack, Discord, and WhatsApp attachment downloads now go through the shared guarded downloader: private and internal addresses are refused (as URL literals, through DNS resolution, and after redirects), responses are capped at 25 MB, and downloads time out after 30 seconds. Slack sends the bot token only on hops to trusted Slack origins, and WhatsApp keeps its access token on Meta's media hosts and the configured Graph origin. Telegram enforces the same size cap and timeout with the Web Fetch API so downloads keep working in runtimes like Cloudflare Workers.

    downloadAttachment in @chat-adapter/shared now resolves headers per hop (pass a function to control what each redirect target receives), forwards the resolved headers to custom transports, and accepts an onResponse hook to reject unexpected final responses before the body is read.

Patch Changes

4.38.1

Patch Changes

4.38.0

Patch Changes

4.37.0

Patch Changes

4.36.0

Patch Changes

4.35.0

Patch Changes

4.34.0

Patch Changes

4.33.0

Minor Changes

  • d4c52ca: add replaceBareMentions, a context-aware bare-@mention resolver that skips code spans, URLs, schemeless hosts, and existing angle-bracket tokens before handing each real @name to a platform-specific replacer

Patch Changes

4.32.0

Patch Changes

4.31.0

Patch Changes

4.30.0

Patch Changes

4.29.0

Minor Changes

  • add2730: support typed Telegram attachment uploads

Patch Changes

4.28.1

Patch Changes

4.28.0

Minor Changes

  • 9824d33: Security fixes for HIGH-severity findings:

    • adapter-slack: Replace timing-unsafe !== with crypto.timingSafeEqual when validating the x-slack-socket-token header on forwarded socket-mode events.
    • adapter-github: In multi-tenant App mode, eagerly auto-detect the bot user ID on the first installation client / first webhook so isMe checks work and self-reply loops are prevented. Falls back to apps.getAuthenticated + users.getByUsername when users.getAuthenticated is unavailable for installation tokens.
    • adapter-linear: Add optional encryptionKey config (or LINEAR_ENCRYPTION_KEY env var) that AES-256-GCM-encrypts accessToken and refreshToken at rest in the state store. Tolerates plaintext records for zero-downtime rollout.
    • adapter-gchat: Fail-closed by default — the constructor now throws ValidationError if neither googleChatProjectNumber nor pubsubAudience is configured. To accept unverified webhooks (development only), set the new disableSignatureVerification: true flag (or GOOGLE_CHAT_DISABLE_SIGNATURE_VERIFICATION=true). Mirrors the Slack adapter's signing-secret requirement.
    • adapter-shared: New decodeKey / encryptToken / decryptToken / isEncryptedTokenData utilities (AES-256-GCM, hex or base64 32-byte keys), shared by Slack and Linear.

Patch Changes

4.27.0

Patch Changes

4.26.0

Patch Changes

4.25.0

Patch Changes

4.24.0

Patch Changes

4.23.0

Patch Changes

4.22.0

Patch Changes

4.21.0

Patch Changes

4.20.2

Patch Changes

4.20.1

Patch Changes

4.20.0

Patch Changes

4.19.0

Patch Changes

4.18.0

Patch Changes

4.17.0

Patch Changes

4.16.1

Patch Changes

4.16.0

Minor Changes

  • 02e7ef6: Implements table markdown rendering, and fully streaming markdown rendering including for Slack which has native streaming. Overhauls adapters to have better fallback-render behavior

Patch Changes

4.15.0

Minor Changes

Patch Changes

4.14.0

Patch Changes

4.13.4

Patch Changes

4.13.3

Patch Changes

4.13.2

Patch Changes

4.13.1

Patch Changes

4.13.0

Patch Changes

4.12.0

Patch Changes

4.11.0

Patch Changes

4.10.1

Patch Changes

4.10.0

Patch Changes

4.9.1

Patch Changes

  • 18ce1d0: Exclude action buttons from card fallback text so they no longer appear in Slack notification previews
    • chat@4.9.1

4.9.0

Patch Changes

  • chat@4.9.0

4.8.0

Patch Changes

  • Updated dependencies [cca9867]
    • chat@4.8.0

4.7.2

Patch Changes

  • chat@4.7.2

4.7.1

Patch Changes

  • Updated dependencies [160f1f7]
    • chat@4.7.1

4.7.0

Patch Changes

  • Updated dependencies [a13f43e]
    • chat@4.7.0

4.6.0

Patch Changes

  • Updated dependencies [68e3f74]
    • chat@4.6.0

4.5.0

Patch Changes

  • Updated dependencies [efa6b36]
    • chat@4.5.0

4.4.1

Patch Changes

4.4.0

Patch Changes

  • Updated dependencies [8ca6371]
    • chat@4.4.0

4.3.0

Minor Changes

Patch Changes

Reference in New Issue View Git Blame Copy Permalink