* fix(flags-core): request gzip on the stream so Bun receives the first datafile
* test(flags-core): expect Accept-Encoding on stream requests in black-box tests
* fix(flags-core): send Accept-Encoding: identity on the stream only when running on Bun
* Trim duplicated vercel flags CLI docs from flags-sdk skill
Point agents at --help for syntax and keep lifecycle/safety guidance that skills must own (EXP-3411).
* Shrink flags-sdk skill description under 1024 chars
Drop duplicate CLI trigger phrases; keep subcommand names once for activation.
* Drop stale skill-tables wording from CLI pointer
* Align flags-sdk skill with EXP-3411 acceptance criteria
Make --help discovery and the vercel-cli cross-link explicit in SKILL.md and providers.md.
* Trim frontmatter subcommand list and drop duplicated CLI prerequisites
* Add CLI-to-SDK glue and existing-flag flow to flags-sdk skill
* Address review: restore rm/unarchive/open in frontmatter, fix split default-variant wording
* Correct set/use-targeting semantics: targeting is paused, not replaced
* Ground CLI lifecycle guidance in public Vercel Flags docs
* Align authentication guidance with vercel.com docs: OIDC default, SDK keys manual
* Fix singleton client auth note; drop nonexistent targeting subcommand
* Consolidate env pull guidance into one section
* Make flags-sdk skill setup-first for discovery
Lead the skill description and structure with install/setup so agents load it for configuration, not only usage. Split setup vs create-flag workflows and sync CLI guidance to create/rules plus timestamp epoch-ms notes (EXP-3256).
* Widen skill title to cover setup and usage
* Drop timestamp CLI notes from this PR
* Keep create vs add CLI rename out of this PR
* Fix setup order and restore skill discovery triggers
Create flags.ts before Flags Explorer, pull FLAGS during configure, and restore frontmatter usage triggers dropped in the setup-first rewrite.
* Shrink skill description under 1024-char limit
Keep setup-first and restored triggers; trim wording so Skills CI validation passes.
* Harden flags-sdk skill setup guidance
Use export {} for empty flags.ts, note Explorer import path when flags are not at root, and clarify FLAGS_SECRET for setup-only.
* Remove Hypertune from flags-sdk skill
Hypertune is no longer supported; drop it from the skill description, references list, and providers guide.
Rename the Proxy function to `proxy` and simplify the `identify` example
with the `Identify` type helper.
Co-authored-by: vercel[bot] <35613825+vercel[bot]@users.noreply.github.com>
Co-authored-by: Dominik Ferber <1765075+dferber90@users.noreply.github.com>
Changesets v3 is the first major release since v2. All packages are now ES
modules, and the dependency tree is smaller.
- @changesets/cli 2.31.0 -> 3.0.0
- @changesets/changelog-github ^0.7.0 -> ^1.0.0
- changesets/action v1.7.0 -> v2.1.0 (v1 supports only Changesets v2)
- root engines.node -> ^22.11 || ^24 || >=26, the requirement of the new CLI
Remove the onlyUpdatePeerDependentsWhenOutOfRange experimental option.
Changesets v3 gives a peer dependent a patch increase, and only when the new
version leaves the declared range. This makes the option redundant for the
release plan.
Empty the ignore list. Changesets v3 does not version private packages by
default, and every ignored package is private.
Set format to false. Changesets v3 no longer bundles Prettier, and it excludes
Biome from formatter auto-detection.
Co-authored-by: vercel[bot] <35613825+vercel[bot]@users.noreply.github.com>
Co-authored-by: Dominik Ferber <1765075+dferber90@users.noreply.github.com>
`hypertune` and `@vercel/microfrontends` resolved to nanoid 3.3.16, which
is vulnerable to an infinite loop when a custom generator is called with
size zero. The existing `nanoid@>=4` override did not cover the v3 range,
so add a matching `nanoid@3: ^3.3.18` override.
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Bumps the vulnerable transitive dependencies flagged by Dependabot via
pnpm overrides, and the direct nanoid dependency in the examples.
- nanoid >= 4 -> ^5.1.16 (GHSA infinite loop on negative/zero size)
- brace-expansion >= 4 -> ^5.0.9 (DoS via unbounded intermediate arrays)
- dompurify -> ^3.4.13 (XSS via detached subtree after IN_PLACE hook removal)
- fast-uri -> ^3.1.5 (host confusion via backslash authority introducer)
- js-yaml 3 -> ^3.15.1, js-yaml 4 -> ^4.3.1 (quadratic CPU in !!omap)
- mermaid -> ^11.16.1 (DoS, prototype pollution, CSS injection)
- postcss -> ^8.5.23 (arbitrary .map file read via sourceMappingURL)
- @sveltejs/kit -> ^2.70.2 (ReDoS in Accept header content negotiation)
image-size (alerts #979, #980) has no patched release yet, so it is left
as-is. It is only used at build time by the docs site.
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* @flags-sdk/posthog: upgrade posthog-node
* @flags-sdk/posthog: make local vs remote evaluation explicit
The default adapter passed POSTHOG_PERSONAL_API_KEY into the runtime
posthog-node client, which enabled local evaluation and started a
feature-flag poller in every warm process. On serverless this produced
large, traffic-independent PostHog feature flag request volume.
Local evaluation is now opt-in via POSTHOG_SECRET_KEY; without it the
adapter evaluates remotely. POSTHOG_PERSONAL_API_KEY is used only by
getProviderData (Flags Explorer) and no longer affects runtime
evaluation. Drops the forced 10s poll interval in favor of the v5
default. Updates docs, README, and tests.
* remove unused @vercel/edge-config dependency
* add remote vs local tradeoffs
* rm edge config tag
* modernize
* rm trimKey
* lockfile
* update
* fixes
* reword changeset
* merge changesets
* reword changelog
@sveltejs/kit was declared as an optional peer with a "*" range, causing
npm to auto-install the newest @sveltejs/kit and pull in its transitive
@sveltejs/vite-plugin-svelte → vite peer chain. In non-SvelteKit projects
already on Vite 7 (via Vitest, Storybook, etc.) this produced a hard
ERESOLVE error requiring `npm install --force`.
Move @sveltejs/kit to devDependencies so the sveltekit entrypoint still
builds and type-generates in the monorepo. SvelteKit consumers always have
@sveltejs/kit installed as the framework, so flags/sveltekit continues to
resolve it from their own tree.
fixes#440
* Stop tracing Next.js control-flow errors as span errors
The `trace()` helper marked spans as errored via `span.setStatus({ code: 2, message })` for every rejection of the traced function. This included errors that Next.js uses for control flow and that the evaluation layer deliberately re-throws via `isInternalNextError`: redirects, notFound, and the rejected hanging promises of aborted prerenders (`HANGING_PROMISE_REJECTION`).
The hanging-promise case is the noisy one in practice. Whenever a runtime prefetch prerender is aborted while a flag evaluation awaits `connection()` or `cookies()` (for example through an `identify` function that reads the request), the evaluation promise rejects with the `HANGING_PROMISE_REJECTION` digest, and every affected flag span reported "During prerendering, `connection()` rejects when the prerender is complete" as its status description. On heavily prefetched routes this produces a large volume of error-annotated spans for behavior that is entirely expected.
The tracing helper now skips the error status for internal Next.js errors in both the promise rejection path and the synchronous throw path, while still ending the span and preserving span-context attributes. Control flow is unchanged: the error keeps propagating to the caller. `isInternalNextError` moves from `src/next/` to `src/lib/` so the shared tracing module can use it without depending on the Next.js entrypoint; it is a plain digest check with no Next.js imports.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* keep tracing framework agnostic (#439)
* Report ignored control-flow errors as successful spans
When `isIgnoredError` classifies an error as control flow, the traced function completed as intended, so the span now gets an explicit Ok status instead of ending with an unset status. This keeps ignored control-flow rejections (like Next.js hanging promise rejections of aborted prerenders) clearly distinguishable from both errored spans and spans that were never finalized.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: Dominik Ferber <dominik.ferber@gmail.com>
* [adapter-launchdarkly] support native Marketplace integration
- Read the Edge Config connection string from EXPERIMENTATION_CONFIG,
falling back to EDGE_CONFIG for the legacy Vercel integration
- Make LAUNCHDARKLY_PROJECT_SLUG / projectSlug optional; it is only used
to deep-link flags to the LaunchDarkly dashboard
* [adapter-launchdarkly] read EXPERIMENTATION_CONFIG only
Align with the Statsig adapter: the default adapter reads the Edge Config
connection string from EXPERIMENTATION_CONFIG only and no longer falls back
to EDGE_CONFIG. Legacy Vercel integration users can set EXPERIMENTATION_CONFIG
to their EDGE_CONFIG value or pass edgeConfigConnectionString explicitly.
* [adapter-launchdarkly] mark changeset as major (breaking change)
* Update changelog to have a single recommendation for legacy EDGE_CONFIG env var
* Bring back LAUNCHDARKLY_PROJECT_SLUG as required
Radix Select injects the selected option label into the trigger via a
client-only portal, so the statically rendered page ships an empty
trigger and the label pops in after hydration. Render the value as
SelectValue children instead, so the label is present in the SSR HTML
(this also disables the portal path via valueNodeHasChildren).
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
github-actions[bot]