Bumps the vulnerable transitive dependencies flagged by Dependabot via
pnpm overrides, and the direct nanoid dependency in the examples.
- nanoid >= 4 -> ^5.1.16 (GHSA infinite loop on negative/zero size)
- brace-expansion >= 4 -> ^5.0.9 (DoS via unbounded intermediate arrays)
- dompurify -> ^3.4.13 (XSS via detached subtree after IN_PLACE hook removal)
- fast-uri -> ^3.1.5 (host confusion via backslash authority introducer)
- js-yaml 3 -> ^3.15.1, js-yaml 4 -> ^4.3.1 (quadratic CPU in !!omap)
- mermaid -> ^11.16.1 (DoS, prototype pollution, CSS injection)
- postcss -> ^8.5.23 (arbitrary .map file read via sourceMappingURL)
- @sveltejs/kit -> ^2.70.2 (ReDoS in Accept header content negotiation)
image-size (alerts #979, #980) has no patched release yet, so it is left
as-is. It is only used at build time by the docs site.
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Update docs and examples to pass the adapter factory directly
(adapter: vercelAdapter) instead of calling it (adapter: vercelAdapter()),
reflecting the AdapterOrFactory support in flag(). Applied consistently to
all zero-arg factory adapters (vercel, edge-config, custom adapter examples).
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* prepare
* origin
* prepare script
* step
* redo peer deps
* wip
* continue
* every 5 secs
* connect flag network
* add shirt-shop-vercel
* upgrade
* push
* update endpoint
* add vercel getProviderData
* fix importts
* Add retries to flag network datasource (#237)
* Fix React Server Components CVE vulnerabilities (#235)
Updated dependencies to fix Next.js and React CVE vulnerabilities.
The fix-react2shell-next tool automatically updated the following packages to their secure versions:
- next
- react-server-dom-webpack
- react-server-dom-parcel
- react-server-dom-turbopack
All package.json files have been scanned and vulnerable versions have been patched to the correct fixed versions based on the official React advisory.
Co-authored-by: Vercel <vercel[bot]@users.noreply.github.com>
* Add retries to flag network datasource when stream closes
Implements automatic retry logic with exponential backoff when the flag network
stream unexpectedly closes. The stream will retry with delays increasing from
1s to a maximum of 30s, allowing the datasource to recover from temporary
network issues while falling back to bundled definitions if initial connection
fails.
Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
* Revert package.json and pnpm-lock changes
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: vercel[bot] <35613825+vercel[bot]@users.noreply.github.com>
Co-authored-by: Vercel <vercel[bot]@users.noreply.github.com>
Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com>
* use ndjson (#238)
* try
* try
* use debugLog
* replace testkey
* never retry on 4xx
* Track FLAG_CONFIG_READ events
* update @biomejs/biome
* send user-agent, rm terminate handling, fix tests
* extract usage-tracker and add tests
* rm EdgeConfigDataSource
* export EvaluationParams and EvaluationResult
* drop edge-config dep
* drop edge config from @flags-sdk/vercel
* adapt @flags-sdk/vercel
* fix integration tests
* wip
* assert ingest requests
* race initial connection, retry in background, abort on shutdown
* rm store
* make readBundledDefinitions async
* read from @vercel/flags-definitions/definitions.json
* add ensureFallback fn
* getDefaultFlagsClient() → flagsClient
* rm process.pid
* rm webpackIgnore: true
* require fallbacks at build time on vercel only
* test in layout
* vercel-flags prepare --verbose
* rm prebuild script
* ensure fallback from instrumentation.ts
* rm last process.pid
* print warning
* Track duration and cache status for config reads
* add tests
* await stream in initialize method
* consumeStream → runStreamLoop
* replace subscribe with doInitialize
* add webpackIgnore
* make @vercel/flags-core a peer dep
* fresh start
* debug
* step
* next-connection
* avoid opening stream during builds
* undo next specific exports
* handle abort
* fake
* poc
* clean up imports
* next-js exports
* upgrade next
* move "use cache" up
* move "use cache" handling to client
* split index.default.ts and index.next-js.ts
* separate
* jsdoc
* use scoped map instead of passing ref
* move jsdoc
* rename
* keep dataSource private, clean clientMap
* reset retryCount on connection; abort on 401
* break after 10 retries
* add backoff with jitter + limit
* add usage tracking and read fallback
* refactor
* extract stream-connection, update tests
* add tests
* reduce test amount
* add perf metadata
* add BaseEvaluationResult
* getData → read
* rm shirt-shop-vercel
* drop next-connection
* update pnpm-lock
* getMetadata → getInfo
* add getDatafile
* DataSourceData → Datafile
* merge metrics into datafile
* simplify metrics
* use embed for getDatafile
* add comment
* comment
* bring shirt-shop-vercel back
* try setCacheLife
* support cache components in OpenFeature import
* use new format
* rm cli
* fix origin
* use bundler
* simplify
* ensure warning is highlighted in build logs
* warn only once
* ensureFallback → getFallbackDatafile
* improve perf
* avoid creating new objects
* fix type issues
* stop exposing createRawClient
* fix: mark stream reconnection loop as intentional fire-and-forget
Add void operator before async IIFE to explicitly indicate the floating
promise is intentional, preventing linter warnings and making the code
intent clearer to future maintainers.
* fix: handle malformed JSON in stream messages gracefully
Wrap JSON.parse in try/catch to prevent crashes from malformed server
responses. Logs a warning and skips the invalid message instead of
crashing the stream connection handler.
* fix: add bounds checking for variant index access
Add getVariant() helper that throws a descriptive error if the variant
index is out of bounds. This prevents silent undefined returns when
variant indices are invalid, making issues easier to debug in production.
* fix: prevent concurrent initialization race condition
Add initializingPromise to coordinate concurrent initialize() calls.
The fast boolean check is preserved for the hot path, while concurrent
calls during initialization now await the same promise instead of
triggering multiple initializations.
* fix: add timeout and retry logic to fetchDatafile
- Add 10-second timeout using AbortController to prevent indefinite hangs
- Add exponential backoff retry (up to 3 attempts) for transient failures
- Skip retries for 4xx client errors (except 429 rate limiting)
- Improves resilience against network issues in production
* fix: prevent race condition in ensureStream
Use local variable for abortController and store streamPromise
immediately after creation. This prevents concurrent calls from
creating multiple streams or overwriting the abort controller
before the promise is stored.
* fix: prevent race condition in read() by capturing data reference
Capture this.data reference at the start of read() to ensure consistent
state throughout the method. The onMessage callback from the stream can
update this.data during async operations, which could cause inconsistent
behavior if the reference changes mid-operation.
* comments
* add streaming connectionState
* update usage
* fix init
* try to avoid hanging promise
* update attw, add types
* get rid of unnecessary async/await
* avoid printing the warning
* distinct warnings
* don't export cachedFns
* add CLAUDE.md
* jsdoc
* clear timeout
* export Datafile
* avoid exposing data sources
* simplify
* types
* avoid dangling timeout
* more options
* tests
* allow options in createClient
* DatafileInput
* better options
* Update event tracking to use streams
* Revert "Update event tracking to use streams"
This reverts commit cff740a18c.
* fix datafile input type
* type
* handle shutdown and re-init
* defensive
* retry stream for up to 15 minutes
* Update event reporting to use ndjson for more events
* Revert "Update event reporting to use ndjson for more events"
This reverts commit f70a7bfc59.
* Add debug logs to the usage tracker
* [adapter-vercel] fix getProviderData
* [adapter-vercel] only return vercel flags from getProviderData
* fix
* rm getInfo
* rm tgz
* rm example
* rm next/connection from gitignore
* rm unused deps
* use DatafileInput type
* fix tests
* ensure pollCount > 0
* fix type issues
* fix retry logic
* upgrade @sveltejs/kit
* resolve ci issues
---------
Co-authored-by: Luis Meyer <luis.meyer@vercel.com>
Co-authored-by: vercel[bot] <35613825+vercel[bot]@users.noreply.github.com>
Co-authored-by: Vercel <vercel[bot]@users.noreply.github.com>
Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com>
Co-authored-by: Andy Bitz <artzbitz@gmail.com>
Updated dependencies to fix Next.js and React CVE vulnerabilities.
The fix-react2shell-next tool automatically updated the following packages to their secure versions:
- next
- react-server-dom-webpack
- react-server-dom-parcel
- react-server-dom-turbopack
All package.json files have been scanned and vulnerable versions have been patched to the correct fixed versions based on the official React advisory.
Co-authored-by: Vercel <vercel[bot]@users.noreply.github.com>
* chore: add test `.env` files
* add EDGE_CONFIG env var
Adds the EDGE_CONFIG env var to the snippets example with a read-only token meant for public consumption.
---------
Co-authored-by: Dominik Ferber <dominik.ferber@gmail.com>
* use `$env/dynamic/private` from SvelteKit for convenience: people don't have to pass FLAGS_SECRET manually anymore then
* allow flag to be called outside of the lifecycle of the handle hook, with a request object being the key for deduplication etc
* add support for identifiers
* fix types
* new function for managing precomputed flags
* align with next.js API instead
* update example app
* lockfile
* test
* fix example
* restructure examples app
* make it two flags to show power of precompute + code
* add manual approach
* lets see if preview deployment is picked up
* change crypto usage to be usable in middleware
* make sveltekit flags pkg usable within edge middleware
* use ISR
* changeset
* enhance error message
* use static env instead of dynamic env
* bump kit
* use vercel adapter
* make sure Vite tooling is used for sveltekit entry point
---------
Co-authored-by: Dominik Ferber <dominik.ferber@gmail.com>
* Create LaunchDarkly adapter
* Update example to include a LaunchDarkly flag
* Add missing env to turbo
* Rename to defaultLaunchDarklyAdapter
* Add winter sale example for providers
* Update winter-sale
* Document usage in readme
* Allow to set the default value through the adapter
* Fix readme
* Add default value for adapter
* Make argument optional
* Add @ts-expect-error
* Add a LaunchDarkly adapter (#10)
* add ld example
* reword
* remove winter-sale example
* remove defaultValue
* use @flags-sdk/launchdarkly
* add install steps
* add changeset
* move @vercel/edge-config to peer deps
* add more secrets
* spell out name
* remove unused env var
* rename properties
* Capitalize
* Change import
* Fix more imports
* expose ldClient
* move peerDeps to real deps
* clarify Edge Config requirement in README
* remove adapter-launchdarkly snippet
* upgrade next@canary
* polish @flags-sdk/launchdarkly README
---------
Co-authored-by: Dominik Ferber <dominik.ferber@gmail.com>
* Revert "Revert "add dark mode support (#53)" (#54)"
This reverts commit 2161f4d5f1.
* switch to cssVariables: false
* bring back darkmode for DemoFlag
* fix suspense example
* fix skeleton example
* throw when decide returns undefined
* throw on undefined unless defaultValue is defined
* wip
* bring back JsonValue
* do not enforce on typescript level for now
* add changeset
* mention exported types
* add precise types
* fix summer-sale example
Dominik Ferber