`hypertune` and `@vercel/microfrontends` resolved to nanoid 3.3.16, which
is vulnerable to an infinite loop when a custom generator is called with
size zero. The existing `nanoid@>=4` override did not cover the v3 range,
so add a matching `nanoid@3: ^3.3.18` override.
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Bumps the vulnerable transitive dependencies flagged by Dependabot via
pnpm overrides, and the direct nanoid dependency in the examples.
- nanoid >= 4 -> ^5.1.16 (GHSA infinite loop on negative/zero size)
- brace-expansion >= 4 -> ^5.0.9 (DoS via unbounded intermediate arrays)
- dompurify -> ^3.4.13 (XSS via detached subtree after IN_PLACE hook removal)
- fast-uri -> ^3.1.5 (host confusion via backslash authority introducer)
- js-yaml 3 -> ^3.15.1, js-yaml 4 -> ^4.3.1 (quadratic CPU in !!omap)
- mermaid -> ^11.16.1 (DoS, prototype pollution, CSS injection)
- postcss -> ^8.5.23 (arbitrary .map file read via sourceMappingURL)
- @sveltejs/kit -> ^2.70.2 (ReDoS in Accept header content negotiation)
image-size (alerts #979, #980) has no patched release yet, so it is left
as-is. It is only used at build time by the docs site.
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* @flags-sdk/posthog: upgrade posthog-node
* @flags-sdk/posthog: make local vs remote evaluation explicit
The default adapter passed POSTHOG_PERSONAL_API_KEY into the runtime
posthog-node client, which enabled local evaluation and started a
feature-flag poller in every warm process. On serverless this produced
large, traffic-independent PostHog feature flag request volume.
Local evaluation is now opt-in via POSTHOG_SECRET_KEY; without it the
adapter evaluates remotely. POSTHOG_PERSONAL_API_KEY is used only by
getProviderData (Flags Explorer) and no longer affects runtime
evaluation. Drops the forced 10s poll interval in favor of the v5
default. Updates docs, README, and tests.
* remove unused @vercel/edge-config dependency
* add remote vs local tradeoffs
* rm edge config tag
* modernize
* rm trimKey
* lockfile
* update
* fixes
* reword changeset
* merge changesets
* reword changelog
@sveltejs/kit was declared as an optional peer with a "*" range, causing
npm to auto-install the newest @sveltejs/kit and pull in its transitive
@sveltejs/vite-plugin-svelte → vite peer chain. In non-SvelteKit projects
already on Vite 7 (via Vitest, Storybook, etc.) this produced a hard
ERESOLVE error requiring `npm install --force`.
Move @sveltejs/kit to devDependencies so the sveltekit entrypoint still
builds and type-generates in the monorepo. SvelteKit consumers always have
@sveltejs/kit installed as the framework, so flags/sveltekit continues to
resolve it from their own tree.
fixes#440
* docs: update to geistdocs 1.8.0 and drop Flags from OSS dropdown
Bump @vercel/geistdocs to 1.8.0 (eve logo, Streamdown dropped, AI Elements
last) and override navbarOssProducts to exclude Flags SDK on its own site.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* docs: link eve to /docs in OSS dropdown
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Migrate docs app to Geistdocs canary
* Fix docs proxy matcher
* Use Geistdocs UI exports
* Update Geistdocs to 1.3.0
* upgrade geistdocs and fix svelte logo
* add copy prompt to certain docs pages
* migrate to 1.5.0
* refactor(docs): use geistdocs v1.5 Badge, CommandPrompt, ThemeAwareImage
Remove the local copies now exported by @vercel/geistdocs@1.5 and import
them from the package instead:
- Badge -> @vercel/geistdocs/components/badge (provider-list)
- CommandPrompt -> @vercel/geistdocs/components/command-prompt (install-command)
- ThemeAwareImage -> @vercel/geistdocs/components/theme-aware-image
(docs MDX components); migrate the SvelteKit MDX call site to the new
src={{ light, dark }} API.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(docs): restore install switcher width animation
The hero "For humans / For agents" switcher called router.refresh() on
every toggle (added in #366). That remounts/reconciles the switcher
subtree mid-toggle, resetting the CommandPrompt's measured width state so
the command-line width spring never plays — the line snapped instead of
growing.
Drop the refresh: this flag's only consumer is the switcher itself, so the
optimistic override already shows the correct command and the cookie
persists the choice across reloads (the server reads it and renders the
matching prebuilt `[code]`). The refresh changed nothing visible and only
broke the animation. startTransition() does not help, since router.refresh
already runs as a transition.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* refactor(docs): render home code blocks with geistdocs CodeBlock
Replace the hand-rolled shiki token renderer in HighlightedCode with
fumadocs highlight() + the geistdocs CodeBlock, highlighting with the
shared geistShikiTheme so the home page "Effortless setup" blocks match
the documentation (same syntax colors, header, language icon, copy
button, radius). transformerIcon() fills the filename icon slot; the
caption is preserved below.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(docs): equal-height home code blocks
Grow each HighlightedCode block to fill its grid cell (h-full root +
flex-1 wrapper forcing the Card to h-full) so both columns share the
taller block's height and their captions align. The Card and its <pre>
share bg-background-100, so the shorter block fills seamlessly.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* chore(docs): drop dead shadcn tokens (chart-*, sidebar-primary)
Only chart-1..5 and sidebar-primary are unused by both the app and the
geistdocs/fumadocs package CSS. The other shadcn tokens (secondary,
card-foreground, the remaining sidebar-* set, etc.) must stay: the package
stylesheet consumes them via var(--token) for its fd-* utility mappings
and the #nd-sidebar rule, and does not self-define them — the consuming
app has to provide them.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* refactor(docs): migrate consumers off shadcn tokens to Geist scale
Switch every shadcn-token consumer (select, switch, iframe-browser, the
home marketing pages, and the illustrations SVGs) to the Geist --ds-*
scale using the geistdocs PR #75 mapping (foreground->gray-1000,
muted->gray-100, muted-foreground->gray-800, border/input->gray-alpha-400,
ring->gray-600, destructive->red-800, background/card/popover->
background-100, accent->gray-100, etc.).
With no consumers left, drop the entire local shadcn layer from
geistdocs.css (the @theme --color-* mappings and the :root/.dark oklch
palette) and instead override fumadocs --color-fd-* and #nd-sidebar to
--ds-* (so the package's docs UI keeps working without the raw palette),
matching the geistdocs template. The geist utilities themselves come from
@vercel/geistdocs/styles.css.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Update geistdocs.css
* migrate to 1.6.0
* chore(docs): bump @vercel/geistdocs to 1.6.1
Picks up the Next.js logo gradient-id fix so the framework logo renders
correctly in the mobile docs menu.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Update pnpm-lock.yaml
* fix(docs): drop language icons from landing-page code blocks
The home "Effortless setup" snippets are Next.js examples, but the
language-based transformerIcon rendered a React glyph for the .tsx block.
Remove the icons (these blocks never had them) and hide the now-empty
header icon slot so the filename stays flush.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* chore(docs): drop redundant streamdown @source
The streamdown @source pointed at a transitive dep path that doesn't
resolve under pnpm (matched nothing). Streamdown is now sourced upstream
from @vercel/geistdocs's own styles.css, so this line is unneeded.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* update
* bump @vercel/geistdocs
* Update pnpm-lock.yaml
* update
---------
Co-authored-by: christopherkindl <53372002+christopherkindl@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Added check to check skills size
* Change glob -> readdirSync
* Shorten description length
* Added check for name, compatibility and body
* Added back some parts that were removed to avoid regressions
* More cleanup
* Feedback: Used grey-matter for frontmatter parsing
* Added pnpm setup and install deps in Skills Quality job
* Refine triggers
* Extract @vercel/prepare-flags-definitions package
Extract the core flag definitions preparation logic from the Vercel CLI into a standalone, reusable package. This includes:
- prepareFlagsDefinitions() function that collects SDK keys from env, fetches definitions, and writes to node_modules
- hashSdkKey() helper for SHA-256 hashing
- generateDefinitionsModule() for JS module generation with deduplication and lazy parsing
Follows repo conventions: pnpm workspaces, tsup, vitest, ES modules with CJS fallback.
* Add JSDoc comments from original CLI source
* Add inline comments from original CLI source
* Add optional output parameter with debug logging
* Add output.time for datafile fetching
* Add changeset for @vercel/prepare-flags-definitions
* prepare
* origin
* prepare script
* step
* redo peer deps
* wip
* continue
* every 5 secs
* connect flag network
* add shirt-shop-vercel
* upgrade
* push
* update endpoint
* add vercel getProviderData
* fix importts
* Add retries to flag network datasource (#237)
* Fix React Server Components CVE vulnerabilities (#235)
Updated dependencies to fix Next.js and React CVE vulnerabilities.
The fix-react2shell-next tool automatically updated the following packages to their secure versions:
- next
- react-server-dom-webpack
- react-server-dom-parcel
- react-server-dom-turbopack
All package.json files have been scanned and vulnerable versions have been patched to the correct fixed versions based on the official React advisory.
Co-authored-by: Vercel <vercel[bot]@users.noreply.github.com>
* Add retries to flag network datasource when stream closes
Implements automatic retry logic with exponential backoff when the flag network
stream unexpectedly closes. The stream will retry with delays increasing from
1s to a maximum of 30s, allowing the datasource to recover from temporary
network issues while falling back to bundled definitions if initial connection
fails.
Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
* Revert package.json and pnpm-lock changes
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: vercel[bot] <35613825+vercel[bot]@users.noreply.github.com>
Co-authored-by: Vercel <vercel[bot]@users.noreply.github.com>
Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com>
* use ndjson (#238)
* try
* try
* use debugLog
* replace testkey
* never retry on 4xx
* Track FLAG_CONFIG_READ events
* update @biomejs/biome
* send user-agent, rm terminate handling, fix tests
* extract usage-tracker and add tests
* rm EdgeConfigDataSource
* export EvaluationParams and EvaluationResult
* drop edge-config dep
* drop edge config from @flags-sdk/vercel
* adapt @flags-sdk/vercel
* fix integration tests
* wip
* assert ingest requests
* race initial connection, retry in background, abort on shutdown
* rm store
* make readBundledDefinitions async
* read from @vercel/flags-definitions/definitions.json
* add ensureFallback fn
* getDefaultFlagsClient() → flagsClient
* rm process.pid
* rm webpackIgnore: true
* require fallbacks at build time on vercel only
* test in layout
* vercel-flags prepare --verbose
* rm prebuild script
* ensure fallback from instrumentation.ts
* rm last process.pid
* print warning
* Track duration and cache status for config reads
* add tests
* await stream in initialize method
* consumeStream → runStreamLoop
* replace subscribe with doInitialize
* add webpackIgnore
* make @vercel/flags-core a peer dep
* fresh start
* debug
* step
* next-connection
* avoid opening stream during builds
* undo next specific exports
* handle abort
* fake
* poc
* clean up imports
* next-js exports
* upgrade next
* move "use cache" up
* move "use cache" handling to client
* split index.default.ts and index.next-js.ts
* separate
* jsdoc
* use scoped map instead of passing ref
* move jsdoc
* rename
* keep dataSource private, clean clientMap
* reset retryCount on connection; abort on 401
* break after 10 retries
* add backoff with jitter + limit
* add usage tracking and read fallback
* refactor
* extract stream-connection, update tests
* add tests
* reduce test amount
* add perf metadata
* add BaseEvaluationResult
* getData → read
* rm shirt-shop-vercel
* drop next-connection
* update pnpm-lock
* getMetadata → getInfo
* add getDatafile
* DataSourceData → Datafile
* merge metrics into datafile
* simplify metrics
* use embed for getDatafile
* add comment
* comment
* bring shirt-shop-vercel back
* try setCacheLife
* support cache components in OpenFeature import
* use new format
* rm cli
* fix origin
* use bundler
* simplify
* ensure warning is highlighted in build logs
* warn only once
* ensureFallback → getFallbackDatafile
* improve perf
* avoid creating new objects
* fix type issues
* stop exposing createRawClient
* fix: mark stream reconnection loop as intentional fire-and-forget
Add void operator before async IIFE to explicitly indicate the floating
promise is intentional, preventing linter warnings and making the code
intent clearer to future maintainers.
* fix: handle malformed JSON in stream messages gracefully
Wrap JSON.parse in try/catch to prevent crashes from malformed server
responses. Logs a warning and skips the invalid message instead of
crashing the stream connection handler.
* fix: add bounds checking for variant index access
Add getVariant() helper that throws a descriptive error if the variant
index is out of bounds. This prevents silent undefined returns when
variant indices are invalid, making issues easier to debug in production.
* fix: prevent concurrent initialization race condition
Add initializingPromise to coordinate concurrent initialize() calls.
The fast boolean check is preserved for the hot path, while concurrent
calls during initialization now await the same promise instead of
triggering multiple initializations.
* fix: add timeout and retry logic to fetchDatafile
- Add 10-second timeout using AbortController to prevent indefinite hangs
- Add exponential backoff retry (up to 3 attempts) for transient failures
- Skip retries for 4xx client errors (except 429 rate limiting)
- Improves resilience against network issues in production
* fix: prevent race condition in ensureStream
Use local variable for abortController and store streamPromise
immediately after creation. This prevents concurrent calls from
creating multiple streams or overwriting the abort controller
before the promise is stored.
* fix: prevent race condition in read() by capturing data reference
Capture this.data reference at the start of read() to ensure consistent
state throughout the method. The onMessage callback from the stream can
update this.data during async operations, which could cause inconsistent
behavior if the reference changes mid-operation.
* comments
* add streaming connectionState
* update usage
* fix init
* try to avoid hanging promise
* update attw, add types
* get rid of unnecessary async/await
* avoid printing the warning
* distinct warnings
* don't export cachedFns
* add CLAUDE.md
* jsdoc
* clear timeout
* export Datafile
* avoid exposing data sources
* simplify
* types
* avoid dangling timeout
* more options
* tests
* allow options in createClient
* DatafileInput
* better options
* Update event tracking to use streams
* Revert "Update event tracking to use streams"
This reverts commit cff740a18c.
* fix datafile input type
* type
* handle shutdown and re-init
* defensive
* retry stream for up to 15 minutes
* Update event reporting to use ndjson for more events
* Revert "Update event reporting to use ndjson for more events"
This reverts commit f70a7bfc59.
* Add debug logs to the usage tracker
* [adapter-vercel] fix getProviderData
* [adapter-vercel] only return vercel flags from getProviderData
* fix
* rm getInfo
* rm tgz
* rm example
* rm next/connection from gitignore
* rm unused deps
* use DatafileInput type
* fix tests
* ensure pollCount > 0
* fix type issues
* fix retry logic
* upgrade @sveltejs/kit
* resolve ci issues
---------
Co-authored-by: Luis Meyer <luis.meyer@vercel.com>
Co-authored-by: vercel[bot] <35613825+vercel[bot]@users.noreply.github.com>
Co-authored-by: Vercel <vercel[bot]@users.noreply.github.com>
Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com>
Co-authored-by: Andy Bitz <artzbitz@gmail.com>
Dominik Ferber