* docs(skills): separate flag management from SDK setup
* docs(skills): restore vercel link step and route CLI-only requests
* docs(skills): keep setup first and define CLI-only requests
Move the CLI-only section below the setup and create flows, define when a request is CLI-only, and describe link verification once under Project targeting (EXP-3453).
* docs(skills): tighten CLI-only trigger and link to CLI reference
* fix(flags-core): request gzip on the stream so Bun receives the first datafile
* test(flags-core): expect Accept-Encoding on stream requests in black-box tests
* fix(flags-core): send Accept-Encoding: identity on the stream only when running on Bun
* Trim duplicated vercel flags CLI docs from flags-sdk skill
Point agents at --help for syntax and keep lifecycle/safety guidance that skills must own (EXP-3411).
* Shrink flags-sdk skill description under 1024 chars
Drop duplicate CLI trigger phrases; keep subcommand names once for activation.
* Drop stale skill-tables wording from CLI pointer
* Align flags-sdk skill with EXP-3411 acceptance criteria
Make --help discovery and the vercel-cli cross-link explicit in SKILL.md and providers.md.
* Trim frontmatter subcommand list and drop duplicated CLI prerequisites
* Add CLI-to-SDK glue and existing-flag flow to flags-sdk skill
* Address review: restore rm/unarchive/open in frontmatter, fix split default-variant wording
* Correct set/use-targeting semantics: targeting is paused, not replaced
* Ground CLI lifecycle guidance in public Vercel Flags docs
* Align authentication guidance with vercel.com docs: OIDC default, SDK keys manual
* Fix singleton client auth note; drop nonexistent targeting subcommand
* Consolidate env pull guidance into one section
* Make flags-sdk skill setup-first for discovery
Lead the skill description and structure with install/setup so agents load it for configuration, not only usage. Split setup vs create-flag workflows and sync CLI guidance to create/rules plus timestamp epoch-ms notes (EXP-3256).
* Widen skill title to cover setup and usage
* Drop timestamp CLI notes from this PR
* Keep create vs add CLI rename out of this PR
* Fix setup order and restore skill discovery triggers
Create flags.ts before Flags Explorer, pull FLAGS during configure, and restore frontmatter usage triggers dropped in the setup-first rewrite.
* Shrink skill description under 1024-char limit
Keep setup-first and restored triggers; trim wording so Skills CI validation passes.
* Harden flags-sdk skill setup guidance
Use export {} for empty flags.ts, note Explorer import path when flags are not at root, and clarify FLAGS_SECRET for setup-only.
* Remove Hypertune from flags-sdk skill
Hypertune is no longer supported; drop it from the skill description, references list, and providers guide.
Rename the Proxy function to `proxy` and simplify the `identify` example
with the `Identify` type helper.
Co-authored-by: vercel[bot] <35613825+vercel[bot]@users.noreply.github.com>
Co-authored-by: Dominik Ferber <1765075+dferber90@users.noreply.github.com>
Changesets v3 is the first major release since v2. All packages are now ES
modules, and the dependency tree is smaller.
- @changesets/cli 2.31.0 -> 3.0.0
- @changesets/changelog-github ^0.7.0 -> ^1.0.0
- changesets/action v1.7.0 -> v2.1.0 (v1 supports only Changesets v2)
- root engines.node -> ^22.11 || ^24 || >=26, the requirement of the new CLI
Remove the onlyUpdatePeerDependentsWhenOutOfRange experimental option.
Changesets v3 gives a peer dependent a patch increase, and only when the new
version leaves the declared range. This makes the option redundant for the
release plan.
Empty the ignore list. Changesets v3 does not version private packages by
default, and every ignored package is private.
Set format to false. Changesets v3 no longer bundles Prettier, and it excludes
Biome from formatter auto-detection.
Co-authored-by: vercel[bot] <35613825+vercel[bot]@users.noreply.github.com>
Co-authored-by: Dominik Ferber <1765075+dferber90@users.noreply.github.com>
`hypertune` and `@vercel/microfrontends` resolved to nanoid 3.3.16, which
is vulnerable to an infinite loop when a custom generator is called with
size zero. The existing `nanoid@>=4` override did not cover the v3 range,
so add a matching `nanoid@3: ^3.3.18` override.
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Bumps the vulnerable transitive dependencies flagged by Dependabot via
pnpm overrides, and the direct nanoid dependency in the examples.
- nanoid >= 4 -> ^5.1.16 (GHSA infinite loop on negative/zero size)
- brace-expansion >= 4 -> ^5.0.9 (DoS via unbounded intermediate arrays)
- dompurify -> ^3.4.13 (XSS via detached subtree after IN_PLACE hook removal)
- fast-uri -> ^3.1.5 (host confusion via backslash authority introducer)
- js-yaml 3 -> ^3.15.1, js-yaml 4 -> ^4.3.1 (quadratic CPU in !!omap)
- mermaid -> ^11.16.1 (DoS, prototype pollution, CSS injection)
- postcss -> ^8.5.23 (arbitrary .map file read via sourceMappingURL)
- @sveltejs/kit -> ^2.70.2 (ReDoS in Accept header content negotiation)
image-size (alerts #979, #980) has no patched release yet, so it is left
as-is. It is only used at build time by the docs site.
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* @flags-sdk/posthog: upgrade posthog-node
* @flags-sdk/posthog: make local vs remote evaluation explicit
The default adapter passed POSTHOG_PERSONAL_API_KEY into the runtime
posthog-node client, which enabled local evaluation and started a
feature-flag poller in every warm process. On serverless this produced
large, traffic-independent PostHog feature flag request volume.
Local evaluation is now opt-in via POSTHOG_SECRET_KEY; without it the
adapter evaluates remotely. POSTHOG_PERSONAL_API_KEY is used only by
getProviderData (Flags Explorer) and no longer affects runtime
evaluation. Drops the forced 10s poll interval in favor of the v5
default. Updates docs, README, and tests.
* remove unused @vercel/edge-config dependency
* add remote vs local tradeoffs
* rm edge config tag
* modernize
* rm trimKey
* lockfile
* update
* fixes
* reword changeset
* merge changesets
* reword changelog
Luis Meyer