`hypertune` and `@vercel/microfrontends` resolved to nanoid 3.3.16, which
is vulnerable to an infinite loop when a custom generator is called with
size zero. The existing `nanoid@>=4` override did not cover the v3 range,
so add a matching `nanoid@3: ^3.3.18` override.
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Bumps the vulnerable transitive dependencies flagged by Dependabot via
pnpm overrides, and the direct nanoid dependency in the examples.
- nanoid >= 4 -> ^5.1.16 (GHSA infinite loop on negative/zero size)
- brace-expansion >= 4 -> ^5.0.9 (DoS via unbounded intermediate arrays)
- dompurify -> ^3.4.13 (XSS via detached subtree after IN_PLACE hook removal)
- fast-uri -> ^3.1.5 (host confusion via backslash authority introducer)
- js-yaml 3 -> ^3.15.1, js-yaml 4 -> ^4.3.1 (quadratic CPU in !!omap)
- mermaid -> ^11.16.1 (DoS, prototype pollution, CSS injection)
- postcss -> ^8.5.23 (arbitrary .map file read via sourceMappingURL)
- @sveltejs/kit -> ^2.70.2 (ReDoS in Accept header content negotiation)
image-size (alerts #979, #980) has no patched release yet, so it is left
as-is. It is only used at build time by the docs site.
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* @flags-sdk/posthog: upgrade posthog-node
* @flags-sdk/posthog: make local vs remote evaluation explicit
The default adapter passed POSTHOG_PERSONAL_API_KEY into the runtime
posthog-node client, which enabled local evaluation and started a
feature-flag poller in every warm process. On serverless this produced
large, traffic-independent PostHog feature flag request volume.
Local evaluation is now opt-in via POSTHOG_SECRET_KEY; without it the
adapter evaluates remotely. POSTHOG_PERSONAL_API_KEY is used only by
getProviderData (Flags Explorer) and no longer affects runtime
evaluation. Drops the forced 10s poll interval in favor of the v5
default. Updates docs, README, and tests.
* remove unused @vercel/edge-config dependency
* add remote vs local tradeoffs
* rm edge config tag
* modernize
* rm trimKey
* lockfile
* update
* fixes
* reword changeset
* merge changesets
* reword changelog
@sveltejs/kit was declared as an optional peer with a "*" range, causing
npm to auto-install the newest @sveltejs/kit and pull in its transitive
@sveltejs/vite-plugin-svelte → vite peer chain. In non-SvelteKit projects
already on Vite 7 (via Vitest, Storybook, etc.) this produced a hard
ERESOLVE error requiring `npm install --force`.
Move @sveltejs/kit to devDependencies so the sveltekit entrypoint still
builds and type-generates in the monorepo. SvelteKit consumers always have
@sveltejs/kit installed as the framework, so flags/sveltekit continues to
resolve it from their own tree.
fixes#440
* Stop tracing Next.js control-flow errors as span errors
The `trace()` helper marked spans as errored via `span.setStatus({ code: 2, message })` for every rejection of the traced function. This included errors that Next.js uses for control flow and that the evaluation layer deliberately re-throws via `isInternalNextError`: redirects, notFound, and the rejected hanging promises of aborted prerenders (`HANGING_PROMISE_REJECTION`).
The hanging-promise case is the noisy one in practice. Whenever a runtime prefetch prerender is aborted while a flag evaluation awaits `connection()` or `cookies()` (for example through an `identify` function that reads the request), the evaluation promise rejects with the `HANGING_PROMISE_REJECTION` digest, and every affected flag span reported "During prerendering, `connection()` rejects when the prerender is complete" as its status description. On heavily prefetched routes this produces a large volume of error-annotated spans for behavior that is entirely expected.
The tracing helper now skips the error status for internal Next.js errors in both the promise rejection path and the synchronous throw path, while still ending the span and preserving span-context attributes. Control flow is unchanged: the error keeps propagating to the caller. `isInternalNextError` moves from `src/next/` to `src/lib/` so the shared tracing module can use it without depending on the Next.js entrypoint; it is a plain digest check with no Next.js imports.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* keep tracing framework agnostic (#439)
* Report ignored control-flow errors as successful spans
When `isIgnoredError` classifies an error as control flow, the traced function completed as intended, so the span now gets an explicit Ok status instead of ending with an unset status. This keeps ignored control-flow rejections (like Next.js hanging promise rejections of aborted prerenders) clearly distinguishable from both errored spans and spans that were never finalized.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: Dominik Ferber <dominik.ferber@gmail.com>
* [adapter-launchdarkly] support native Marketplace integration
- Read the Edge Config connection string from EXPERIMENTATION_CONFIG,
falling back to EDGE_CONFIG for the legacy Vercel integration
- Make LAUNCHDARKLY_PROJECT_SLUG / projectSlug optional; it is only used
to deep-link flags to the LaunchDarkly dashboard
* [adapter-launchdarkly] read EXPERIMENTATION_CONFIG only
Align with the Statsig adapter: the default adapter reads the Edge Config
connection string from EXPERIMENTATION_CONFIG only and no longer falls back
to EDGE_CONFIG. Legacy Vercel integration users can set EXPERIMENTATION_CONFIG
to their EDGE_CONFIG value or pass edgeConfigConnectionString explicitly.
* [adapter-launchdarkly] mark changeset as major (breaking change)
* Update changelog to have a single recommendation for legacy EDGE_CONFIG env var
* Bring back LAUNCHDARKLY_PROJECT_SLUG as required
Radix Select injects the selected option label into the trigger via a
client-only portal, so the statically rendered page ships an empty
trigger and the label pops in after hydration. Render the value as
SelectValue children instead, so the label is present in the SSR HTML
(this also disables the portal path via valueNodeHasChildren).
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Add FLAGS_EVALUATION metric
* Track variant IDs in evaluation results
* report null instead of fallback
* bucket to the previous minute
* replace variant null with undefined
* invert
* use option instead of env var
* Add track option to black-box flag tests
* Add evaluation metrics controls and flush reasons
* increase max_count
* defaul track:true
* increase batch
* Bound ingest POSTs to 2000 events per request
Flushes can overshoot the scheduler's MAX_COUNT because the map read
happens in a microtask, so a single POST could exceed the server-side
maxItems cap and be rejected with a 400. Chunk sendIngestEvents so each
POST carries at most MAX_EVENTS_PER_REQUEST events.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Remove count-based flushing from the scheduler
Flushing is now purely time-based (idle window, max window, shutdown).
Batches are only cut down to size when the ingest events are sent, via
the 2000-event chunking in sendIngestEvents, which keeps every POST
below the server-side maxItems cap.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* cleanup
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Replace the raw `npx skills add https://github.com/vercel/vercel --skill
vercel-cli` command with the scoped `vercel/vercel@vercel-cli` identifier
and reframe it as a user-facing suggestion rather than an agent
auto-install. Addresses Snyk audit W012 (unverifiable external
dependency / runtime URL that controls the agent).
Update docs and examples to pass the adapter factory directly
(adapter: vercelAdapter) instead of calling it (adapter: vercelAdapter()),
reflecting the AdapterOrFactory support in flag(). Applied consistently to
all zero-arg factory adapters (vercel, edge-config, custom adapter examples).
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* docs: update to geistdocs 1.8.0 and drop Flags from OSS dropdown
Bump @vercel/geistdocs to 1.8.0 (eve logo, Streamdown dropped, AI Elements
last) and override navbarOssProducts to exclude Flags SDK on its own site.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* docs: link eve to /docs in OSS dropdown
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
github-actions[bot]