Rename the Proxy function to `proxy` and simplify the `identify` example
with the `Identify` type helper.
Co-authored-by: vercel[bot] <35613825+vercel[bot]@users.noreply.github.com>
Co-authored-by: Dominik Ferber <1765075+dferber90@users.noreply.github.com>
Changesets v3 is the first major release since v2. All packages are now ES
modules, and the dependency tree is smaller.
- @changesets/cli 2.31.0 -> 3.0.0
- @changesets/changelog-github ^0.7.0 -> ^1.0.0
- changesets/action v1.7.0 -> v2.1.0 (v1 supports only Changesets v2)
- root engines.node -> ^22.11 || ^24 || >=26, the requirement of the new CLI
Remove the onlyUpdatePeerDependentsWhenOutOfRange experimental option.
Changesets v3 gives a peer dependent a patch increase, and only when the new
version leaves the declared range. This makes the option redundant for the
release plan.
Empty the ignore list. Changesets v3 does not version private packages by
default, and every ignored package is private.
Set format to false. Changesets v3 no longer bundles Prettier, and it excludes
Biome from formatter auto-detection.
Co-authored-by: vercel[bot] <35613825+vercel[bot]@users.noreply.github.com>
Co-authored-by: Dominik Ferber <1765075+dferber90@users.noreply.github.com>
`hypertune` and `@vercel/microfrontends` resolved to nanoid 3.3.16, which
is vulnerable to an infinite loop when a custom generator is called with
size zero. The existing `nanoid@>=4` override did not cover the v3 range,
so add a matching `nanoid@3: ^3.3.18` override.
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Bumps the vulnerable transitive dependencies flagged by Dependabot via
pnpm overrides, and the direct nanoid dependency in the examples.
- nanoid >= 4 -> ^5.1.16 (GHSA infinite loop on negative/zero size)
- brace-expansion >= 4 -> ^5.0.9 (DoS via unbounded intermediate arrays)
- dompurify -> ^3.4.13 (XSS via detached subtree after IN_PLACE hook removal)
- fast-uri -> ^3.1.5 (host confusion via backslash authority introducer)
- js-yaml 3 -> ^3.15.1, js-yaml 4 -> ^4.3.1 (quadratic CPU in !!omap)
- mermaid -> ^11.16.1 (DoS, prototype pollution, CSS injection)
- postcss -> ^8.5.23 (arbitrary .map file read via sourceMappingURL)
- @sveltejs/kit -> ^2.70.2 (ReDoS in Accept header content negotiation)
image-size (alerts #979, #980) has no patched release yet, so it is left
as-is. It is only used at build time by the docs site.
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* @flags-sdk/posthog: upgrade posthog-node
* @flags-sdk/posthog: make local vs remote evaluation explicit
The default adapter passed POSTHOG_PERSONAL_API_KEY into the runtime
posthog-node client, which enabled local evaluation and started a
feature-flag poller in every warm process. On serverless this produced
large, traffic-independent PostHog feature flag request volume.
Local evaluation is now opt-in via POSTHOG_SECRET_KEY; without it the
adapter evaluates remotely. POSTHOG_PERSONAL_API_KEY is used only by
getProviderData (Flags Explorer) and no longer affects runtime
evaluation. Drops the forced 10s poll interval in favor of the v5
default. Updates docs, README, and tests.
* remove unused @vercel/edge-config dependency
* add remote vs local tradeoffs
* rm edge config tag
* modernize
* rm trimKey
* lockfile
* update
* fixes
* reword changeset
* merge changesets
* reword changelog
@sveltejs/kit was declared as an optional peer with a "*" range, causing
npm to auto-install the newest @sveltejs/kit and pull in its transitive
@sveltejs/vite-plugin-svelte → vite peer chain. In non-SvelteKit projects
already on Vite 7 (via Vitest, Storybook, etc.) this produced a hard
ERESOLVE error requiring `npm install --force`.
Move @sveltejs/kit to devDependencies so the sveltekit entrypoint still
builds and type-generates in the monorepo. SvelteKit consumers always have
@sveltejs/kit installed as the framework, so flags/sveltekit continues to
resolve it from their own tree.
fixes#440
* Stop tracing Next.js control-flow errors as span errors
The `trace()` helper marked spans as errored via `span.setStatus({ code: 2, message })` for every rejection of the traced function. This included errors that Next.js uses for control flow and that the evaluation layer deliberately re-throws via `isInternalNextError`: redirects, notFound, and the rejected hanging promises of aborted prerenders (`HANGING_PROMISE_REJECTION`).
The hanging-promise case is the noisy one in practice. Whenever a runtime prefetch prerender is aborted while a flag evaluation awaits `connection()` or `cookies()` (for example through an `identify` function that reads the request), the evaluation promise rejects with the `HANGING_PROMISE_REJECTION` digest, and every affected flag span reported "During prerendering, `connection()` rejects when the prerender is complete" as its status description. On heavily prefetched routes this produces a large volume of error-annotated spans for behavior that is entirely expected.
The tracing helper now skips the error status for internal Next.js errors in both the promise rejection path and the synchronous throw path, while still ending the span and preserving span-context attributes. Control flow is unchanged: the error keeps propagating to the caller. `isInternalNextError` moves from `src/next/` to `src/lib/` so the shared tracing module can use it without depending on the Next.js entrypoint; it is a plain digest check with no Next.js imports.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* keep tracing framework agnostic (#439)
* Report ignored control-flow errors as successful spans
When `isIgnoredError` classifies an error as control flow, the traced function completed as intended, so the span now gets an explicit Ok status instead of ending with an unset status. This keeps ignored control-flow rejections (like Next.js hanging promise rejections of aborted prerenders) clearly distinguishable from both errored spans and spans that were never finalized.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: Dominik Ferber <dominik.ferber@gmail.com>
Dominik Ferber