mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-10-06 10:48:12 +02:00
d8b95805314c70b13d9efce338cbc287c2afb4e1
129
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 dependabot[bot]
|
1f92011f99 |
chore(deps): bump dompurify from 3.4.13 to 3.4.14 (#12266)
Bumps [dompurify](https://github.com/cure53/DOMPurify) from 3.4.13 to 3.4.14. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/cure53/DOMPurify/releases">dompurify's releases</a>.</em></p> <blockquote> <h2>DOMPurify 3.4.14</h2> <ul> <li>Fixed an issue with possible bypasses when risky tags are allow-listed, thanks <a href="https://github.com/AlirezaRouhbakhsh"><code>@AlirezaRouhbakhsh</code></a></li> <li>Fixed a couple of edge cases with mixed document contexts, thanks <a href="https://github.com/fishjojo1"><code>@fishjojo1</code></a></li> <li>Added the SVG <code>pointer-events</code> and <code>vector-effect</code> presentation attributes to the allow-list, thanks <a href="https://github.com/Jaybhade"><code>@Jaybhade</code></a></li> <li>Conducted another refactoring run, removed dead branches and duplicated logic, flattened attribute validation</li> <li>Updated the documentation in several spots, README, wiki, etc., thanks <a href="https://github.com/Akokonunes"><code>@Akokonunes</code></a></li> <li>Updated several development dependencies and CI workflow actions</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/cure53/DOMPurify/commit/4e6fe24173f1a85eafacd95e3c82966e29d34d49"><code>4e6fe24</code></a> release: 3.4.14 (<a href="https://redirect.github.com/cure53/DOMPurify/issues/1587">#1587</a>)</li> <li>See full diff in <a href="https://github.com/cure53/DOMPurify/compare/3.4.13...3.4.14">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
daa2391021 |
chore(deps): bump @aws-sdk/client-s3 from 3.1120.0 to 3.1122.0 (#12261)
Bumps [@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3) from 3.1120.0 to 3.1122.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/aws/aws-sdk-js-v3/releases">@aws-sdk/client-s3's releases</a>.</em></p> <blockquote> <h2>v3.1122.0</h2> <h4>3.1122.0(2026-08-31)</h4> <h5>Documentation Changes</h5> <ul> <li><strong>client-controltower:</strong> Updated the descriptions for the AWS Control Tower ListEnabledControls API parameters to make them more accurate and intuitive. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/c54ac4e6019f585fcf54a956b8d30e38c6cb1a86">c54ac4e6</a>)</li> </ul> <h5>New Features</h5> <ul> <li><strong>client-pinpoint-sms-voice-v2:</strong> AWS End User Messaging SMS now returns ConditionalBehavior on DescribeRegistrationFieldDefinitions, allowing you to programmatically discover which registration fields are required, optional, or disallowed based on the values of other fields in the same form. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/9cbace13989c31d55c45812ee801a29cf90f00ed">9cbace13</a>)</li> <li><strong>client-customer-profiles:</strong> This release introduces new APIs for segment membership events allowing segment definition membership events to be exported to a kinesis stream for downstream processing. Additionally, includes new calculated attribute statistic and 2 new segment dimension types. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/be1a9dab4280a118cd0e47c7aaacee919e01c02b">be1a9dab</a>)</li> <li><strong>client-sagemaker:</strong> Amazon SageMaker Batch Transform now supports G6e instances, powered by NVIDIA L40S Tensor Core GPUs. G6e instances are the most cost-efficient GPU instances for deploying generative AI models and the highest-performance GPU instances for spatial computing workloads. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/b063cf77a91073f3b32a33a1386f20978b646059">b063cf77</a>)</li> <li><strong>client-quicksight:</strong> This release adds support for managing apps in Amazon QuickSight with ListApps, SearchApps, DescribeApp, DescribeAppPermissions, UpdateAppPermissions, and DeleteApp (<a href="https://github.com/aws/aws-sdk-js-v3/commit/98a49570d50f800f74fce9014ec4ab0985fc0775">98a49570</a>)</li> <li><strong>client-connect:</strong> Added support for global routing on Amazon Connect Global Resiliency instances. New APIs GetCrossRegionRouting and UpdateCrossRegionRouting allow you to view and control cross-region contact routing between linked instances, so both Regions are active at all times. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/ce41026342e42c9454be6c68ef24fe721f8149f2">ce410263</a>)</li> <li><strong>client-agent-registry-control:</strong> AWS Agent Registry becomes Generally Available (<a href="https://github.com/aws/aws-sdk-js-v3/commit/e41244e9301730ac7632a4e5f67bb2933156769c">e41244e9</a>)</li> <li><strong>client-kinesis:</strong> Adds support for data delivery to Amazon S3 Tables (Apache Iceberg) and general purpose Amazon S3 buckets with new CreateChannel, UpdateChannel, DeleteChannel, DescribeChannel, and ListChannels APIs for Amazon Kinesis Data Streams. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/64ebb058e0b7ae64bd240c7ae325099fc64ab43a">64ebb058</a>)</li> <li><strong>client-agent-registry:</strong> AWS Agent Registry becomes Generally Available (<a href="https://github.com/aws/aws-sdk-js-v3/commit/e60306f198e7ad374089161aa448602dab590287">e60306f1</a>)</li> <li><strong>client-devops-agent:</strong> Adds support for Slack bidirectional communication configuration in AWS DevOps Agent agent spaces. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/75bc6d6da3f88c398be5a737ad01d8d631773fcf">75bc6d6d</a>)</li> <li><strong>client-kafkaconnect:</strong> Amazon MSK Connect now supports restarting newly created connectors via the asynchronous RestartConnector API. Restart all tasks or only failed tasks, while preserving configuration and committed offsets. This returns a connector operation ARN that you can track with DescribeConnectorOperation. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/8771afafd4c1723c29c1745ff8683145a837bda2">8771afaf</a>)</li> <li><strong>client-support:</strong> AWS Support now allows up to 10 attachments (150 MB each) per case correspondence, up from 3 at 5 MB. Customers can share large diagnostic logs, heap dumps, and packet captures directly in cases to reduce back-and-forth and speed up resolution. Available in US East, US West, and Europe (Ireland). (<a href="https://github.com/aws/aws-sdk-js-v3/commit/4ddd79c10633ffa37d957d96313bdffddcba4867">4ddd79c1</a>)</li> <li><strong>client-workspaces-instances:</strong> Amazon WorkSpaces Core managed instances now support nested virtualization. Customers can enable nested virtualization with supported instance types at launch via CpuOptions.NestedVirtualization in CreateWorkspaceInstance to run hypervisors and virtual machines inside their WorkSpaces Instance. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/29587d1236c8805f7f72305e06a011bfc48ae55c">29587d12</a>)</li> </ul> <hr /> <p>For list of updated packages, view <strong>updated-packages.md</strong> in <strong>assets-3.1122.0.zip</strong></p> <h2>v3.1121.0</h2> <h4>3.1121.0(2026-08-28)</h4> <h5>New Features</h5> <ul> <li><strong>client-ecs:</strong> Amazon Elastic Container Service - This release adds support for early success criteria on ECS rolling deployments, letting deployment complete once a configurable percentage of tasks are healthy, with configurable BLOCKING (required) or DEFERRED (asynchronous) cleanup of previous service revisions. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/ef22d750f27bd01ff6b88b8e1cc0f34efea8d171">ef22d750</a>)</li> <li><strong>client-healthlake:</strong> New HealthLake API, RestoreFHIRDatastore, providing the capability to restore active datastores to a point in time within the last 30 days or recover a deleted datastore from the delete snapshot. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/6249174262656b83d0bba16cf59ba892b849a707">62491742</a>)</li> <li><strong>client-bedrock-agentcore:</strong> AgentCore Memory now supports direct ingestion into long-term memory via IngestData API (<a href="https://github.com/aws/aws-sdk-js-v3/commit/20d652de566b291145576f6e4c24a7c8da4ea2be">20d652de</a>)</li> <li><strong>client-partnercentral-selling:</strong> Releasing PARC, new APN Program that lets sellers add solftware revenue details to aws opportunity summary (<a href="https://github.com/aws/aws-sdk-js-v3/commit/2b6350f01269baa5e6d079a93ff9f6b0804d982f">2b6350f0</a>)</li> <li><strong>client-cognito-identity-provider:</strong> Adds two new operations - GetClientToken which allows M2M auth through the SDK, and DescribeTermsByClient to find which Terms are associated with a user-pool client without knowing the Terms resource id. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/86dffd282f1ac269d1268f9a75f1550df61c5cc6">86dffd28</a>)</li> <li><strong>client-bedrock-agent:</strong> Adds an optional syncSchedule field to CreateDataSource and UpdateDataSource for Managed Knowledge Bases data source connectors, so a data source can sync automatically on a daily, weekly, or monthly schedule. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/a8d3714a751f972452553ba631a98176e6ea584c">a8d3714a</a>)</li> </ul> <hr /> <p>For list of updated packages, view <strong>updated-packages.md</strong> in <strong>assets-3.1121.0.zip</strong></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md">@aws-sdk/client-s3's changelog</a>.</em></p> <blockquote> <h1><a href="https://github.com/aws/aws-sdk-js-v3/compare/v3.1121.0...v3.1122.0">3.1122.0</a> (2026-08-31)</h1> <p><strong>Note:</strong> Version bump only for package <code>@aws-sdk/client-s3</code></p> <h1><a href="https://github.com/aws/aws-sdk-js-v3/compare/v3.1120.0...v3.1121.0">3.1121.0</a> (2026-08-28)</h1> <p><strong>Note:</strong> Version bump only for package <code>@aws-sdk/client-s3</code></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/aws/aws-sdk-js-v3/commit/e1cf460a1e4707e137931804e3e7b71a8392f227"><code>e1cf460</code></a> Publish v3.1122.0</li> <li><a href="https://github.com/aws/aws-sdk-js-v3/commit/e53a25aafbdd772c90d26471dc271e383f1daf71"><code>e53a25a</code></a> Publish v3.1121.0</li> <li>See full diff in <a href="https://github.com/aws/aws-sdk-js-v3/commits/v3.1122.0/clients/client-s3">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
a0028d7e1b |
chore(deps-dev): bump vitest from 4.1.10 to 4.1.11 (#12262)
Bumps [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) from 4.1.10 to 4.1.11. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vitest-dev/vitest/releases">vitest's releases</a>.</em></p> <blockquote> <h2>v4.1.11</h2> <h3> 🐞 Bug Fixes</h3> <ul> <li>Revive global concurrency limit for test lifecycle [backport to v4] - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> and <a href="https://github.com/hi-ogawa"><code>@hi-ogawa</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10992">vitest-dev/vitest#10992</a> <a href="https://github.com/vitest-dev/vitest/commit/5146df80b"><!-- raw HTML omitted -->(5146d)<!-- raw HTML omitted --></a></li> <li><strong>browser</strong>: <ul> <li>Encode iframeId in tester iframe URL [backport to v4] - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a>, <strong>Pduhard</strong> and <strong>Claude Opus 4.8</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10955">vitest-dev/vitest#10955</a> <a href="https://github.com/vitest-dev/vitest/commit/10b2cd201"><!-- raw HTML omitted -->(10b2c)<!-- raw HTML omitted --></a></li> <li>Trigger playwright/chromium gc on lower disk availability [backport to v4] - by <a href="https://github.com/hi-ogawa"><code>@hi-ogawa</code></a>, <strong>Hiroshi Ogawa</strong> and <strong>OpenCode</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10951">vitest-dev/vitest#10951</a> <a href="https://github.com/vitest-dev/vitest/commit/9851dbc41"><!-- raw HTML omitted -->(9851d)<!-- raw HTML omitted --></a></li> </ul> </li> <li><strong>mocker</strong>: <ul> <li>Restrict redirect mocks to the fs allowlist [backport to v4] - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10974">vitest-dev/vitest#10974</a> <a href="https://github.com/vitest-dev/vitest/commit/fe5a11d3c"><!-- raw HTML omitted -->(fe5a1)<!-- raw HTML omitted --></a></li> </ul> </li> </ul> <h5> <a href="https://github.com/vitest-dev/vitest/compare/v4.1.10...v4.1.11">View changes on GitHub</a></h5> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vitest-dev/vitest/commit/9bd8d464e6328c567c2dbcd8fdd977d57a9425c2"><code>9bd8d46</code></a> chore: release v4.1.11 (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/10995">#10995</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/9851dbc41c286a30abfb6b29cce65f3e5b7b40a1"><code>9851dbc</code></a> fix(browser): trigger playwright/chromium gc on lower disk availability [back...</li> <li>See full diff in <a href="https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/vitest">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
6826452856 |
chore(deps): bump sharp from 0.35.3 to 0.35.4 (#12563)
Bumps [sharp](https://github.com/lovell/sharp) from 0.35.3 to 0.35.4. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/lovell/sharp/releases">sharp's releases</a>.</em></p> <blockquote> <h2>v0.35.4</h2> <p><a href="https://github.com/lovell/sharp-libvips/releases/tag/v1.3.3">https://github.com/lovell/sharp-libvips/releases/tag/v1.3.3</a></p> <ul> <li> <p>Bound resize dimensions to coordinate limit.</p> </li> <li> <p>Bound composite left and top to coordinate limit. <a href="https://redirect.github.com/lovell/sharp/pull/4564">#4564</a> <a href="https://github.com/metsw24-max"><code>@metsw24-max</code></a></p> </li> <li> <p>Round palette bit depth up for png and gif colours. <a href="https://redirect.github.com/lovell/sharp/pull/4569">#4569</a> <a href="https://github.com/metsw24-max"><code>@metsw24-max</code></a></p> </li> <li> <p>Ensure tiff.subifd input option is used. <a href="https://redirect.github.com/lovell/sharp/pull/4572">#4572</a> <a href="https://github.com/metsw24-max"><code>@metsw24-max</code></a></p> </li> <li> <p>Ensure <code>info.pages</code> is correct when limiting input page range. <a href="https://redirect.github.com/lovell/sharp/pull/4578">#4578</a> <a href="https://github.com/metsw24-max"><code>@metsw24-max</code></a></p> </li> <li> <p>Improve support for input Streams finishing before output is requested. <a href="https://redirect.github.com/lovell/sharp/pull/4584">#4584</a> <a href="https://github.com/Jaybhade"><code>@Jaybhade</code></a></p> </li> </ul> <h2>v0.35.4-rc.0</h2> <ul> <li> <p>Upgrade to libvips v8.18.6 for upstream bug fixes.</p> </li> <li> <p>Bound resize dimensions to coordinate limit.</p> </li> <li> <p>Bound composite left and top to coordinate limit. <a href="https://redirect.github.com/lovell/sharp/pull/4564">#4564</a> <a href="https://github.com/metsw24-max"><code>@metsw24-max</code></a></p> </li> <li> <p>Round palette bit depth up for png and gif colours. <a href="https://redirect.github.com/lovell/sharp/pull/4569">#4569</a> <a href="https://github.com/metsw24-max"><code>@metsw24-max</code></a></p> </li> <li> <p>Ensure tiff.subifd input option is used. <a href="https://redirect.github.com/lovell/sharp/pull/4572">#4572</a> <a href="https://github.com/metsw24-max"><code>@metsw24-max</code></a></p> </li> <li> <p>Ensure <code>info.pages</code> is correct when limiting input page range. <a href="https://redirect.github.com/lovell/sharp/pull/4578">#4578</a> <a href="https://github.com/metsw24-max"><code>@metsw24-max</code></a></p> </li> <li> <p>Improve support for input Streams finishing before output is requested. <a href="https://redirect.github.com/lovell/sharp/pull/4584">#4584</a> <a href="https://github.com/Jaybhade"><code>@Jaybhade</code></a></p> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/lovell/sharp/commit/7f1a0a22cc285fe180766f4935d50b55af6e8432"><code>7f1a0a2</code></a> Release v0.35.4</li> <li><a href="https://github.com/lovell/sharp/commit/f927818924bc5a9493d822a4e8b23ec5857c52e1"><code>f927818</code></a> Upgrade to sharp-libvips v1.3.3</li> <li><a href="https://github.com/lovell/sharp/commit/e80209240d005c71e1173a50dd9cd4db4ce2a9e6"><code>e802092</code></a> Prerelease v0.35.4-rc.0</li> <li><a href="https://github.com/lovell/sharp/commit/e13eb2f97a0a22f1ef726e8d0cd33f7c56835945"><code>e13eb2f</code></a> CI: Fix wasm32 build (<a href="https://redirect.github.com/lovell/sharp/issues/4589">#4589</a>)</li> <li><a href="https://github.com/lovell/sharp/commit/a82a0b3d58bc25854ad1e925e6eb0a50725d1489"><code>a82a0b3</code></a> Upgrade to libvips v8.18.6</li> <li><a href="https://github.com/lovell/sharp/commit/8044fe43e36d0ea7f8beb89f79a37bb0f3342e84"><code>8044fe4</code></a> Bound resize dimensions to coordinate limit</li> <li><a href="https://github.com/lovell/sharp/commit/147f8591a153bc4a1e199c3fe3150fac2931b30c"><code>147f859</code></a> Docs: changelog entries for <a href="https://redirect.github.com/lovell/sharp/issues/4578">#4578</a> <a href="https://redirect.github.com/lovell/sharp/issues/4584">#4584</a></li> <li><a href="https://github.com/lovell/sharp/commit/ee5bfb853de75a611c64381783b04032a3a897d8"><code>ee5bfb8</code></a> Tests: use yauzl directly rather than via extract-zip wrapper</li> <li><a href="https://github.com/lovell/sharp/commit/7a7788928f8a2a429f45039010a87cee35401694"><code>7a77889</code></a> Bump uraimo/run-on-arch-action from 3.1.0 to 3.2.0 (<a href="https://redirect.github.com/lovell/sharp/issues/4588">#4588</a>)</li> <li><a href="https://github.com/lovell/sharp/commit/ea5bef24c187b2c7ee3fe3cad3b45c8cb67a46fd"><code>ea5bef2</code></a> Improve support for input Streams finishing before output is requested (<a href="https://redirect.github.com/lovell/sharp/issues/4584">#4584</a>)</li> <li>Additional commits viewable in <a href="https://github.com/lovell/sharp/compare/v0.35.3...v0.35.4">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
2e8521e57c |
chore(deps): bump better-auth from 1.7.0 to 1.7.2 (#12565)
Bumps [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) from 1.7.0 to 1.7.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/better-auth/better-auth/releases">better-auth's releases</a>.</em></p> <blockquote> <h2>v1.7.2</h2> <h2><code>better-auth</code></h2> <h3>Bug Fixes</h3> <ul> <li>Fixed permanent user bans to clear expiration dates from previous temporary bans. (<a href="https://redirect.github.com/better-auth/better-auth/pull/10823">#10823</a>)</li> <li>Fixed client types with more plugins being assignable to types declaring fewer plugins. (<a href="https://redirect.github.com/better-auth/better-auth/pull/10907">#10907</a>)</li> <li>Added warnings for invalid signed session data in the cookie cache. (<a href="https://redirect.github.com/better-auth/better-auth/pull/10934">#10934</a>)</li> <li>Fixed disabled MyISAM indexes from satisfying migration index checks. (<a href="https://redirect.github.com/better-auth/better-auth/pull/10877">#10877</a>)</li> <li>Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation. (<a href="https://redirect.github.com/better-auth/better-auth/pull/10875">#10875</a>)</li> <li>Allowed <code>~</code> in relative callback URLs validated by trusted-origin checks. (<a href="https://redirect.github.com/better-auth/better-auth/pull/10041">#10041</a>)</li> <li>Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (<a href="https://redirect.github.com/better-auth/better-auth/pull/10979">#10979</a>)</li> <li>Allowed same-origin form submissions with <code>Referrer-Policy: no-referrer</code> while continuing to reject untrusted origins. (<a href="https://redirect.github.com/better-auth/better-auth/pull/10959">#10959</a>)</li> <li>Improved <code>getTestInstance</code> performance with a faster default password hasher. (<a href="https://redirect.github.com/better-auth/better-auth/pull/10879">#10879</a>)</li> <li>Standardized built-in placeholder emails to the namespaced <code>{identifier}@{namespace}.placeholder.invalid</code> format. (<a href="https://redirect.github.com/better-auth/better-auth/pull/10982">#10982</a>)</li> </ul> <p>For detailed changes, see <a href="https://github.com/better-auth/better-auth/blob/c50200bfc716cf43f5c29a2dd5766f6485c46aa1/packages/better-auth/CHANGELOG.md"><code>CHANGELOG</code></a></p> <h2><code>@better-auth/core</code></h2> <h3>Bug Fixes</h3> <ul> <li>Fixed async context loss in Cloudflare Workers bundles with multiple runtime conditions. (<a href="https://redirect.github.com/better-auth/better-auth/pull/10855">#10855</a>)</li> <li>Fixed auth request logs to respect the configured logger, log level, and disabled setting. (<a href="https://redirect.github.com/better-auth/better-auth/pull/10939">#10939</a>)</li> <li>Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (<a href="https://redirect.github.com/better-auth/better-auth/pull/10979">#10979</a>)</li> <li>Standardized built-in placeholder emails to the namespaced <code>{identifier}@{namespace}.placeholder.invalid</code> format. (<a href="https://redirect.github.com/better-auth/better-auth/pull/10982">#10982</a>)</li> <li>Added synchronous and optional access to the current auth endpoint context. (<a href="https://redirect.github.com/better-auth/better-auth/pull/10938">#10938</a>)</li> </ul> <p>For detailed changes, see <a href="https://github.com/better-auth/better-auth/blob/c50200bfc716cf43f5c29a2dd5766f6485c46aa1/packages/core/CHANGELOG.md"><code>CHANGELOG</code></a></p> <h2><code>@better-auth/oauth-provider</code></h2> <h3>Bug Fixes</h3> <ul> <li>Fixed Client ID Metadata Document registration when clients share at least one supported grant with the server. (<a href="https://redirect.github.com/better-auth/better-auth/pull/11010">#11010</a>)</li> <li>Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (<a href="https://redirect.github.com/better-auth/better-auth/pull/10979">#10979</a>)</li> <li>Fixed relative redirect URLs containing fragments. (<a href="https://redirect.github.com/better-auth/better-auth/pull/10983">#10983</a>)</li> </ul> <p>For detailed changes, see <a href="https://github.com/better-auth/better-auth/blob/c50200bfc716cf43f5c29a2dd5766f6485c46aa1/packages/oauth-provider/CHANGELOG.md"><code>CHANGELOG</code></a></p> <h2><code>@better-auth/drizzle-adapter</code></h2> <h3>Bug Fixes</h3> <ul> <li>Fixed one-to-one Drizzle relations when <code>usePlural</code> is enabled. (<a href="https://redirect.github.com/better-auth/better-auth/pull/10941">#10941</a>)</li> <li>Added validation for missing Drizzle schema fields in compound <code>where</code> clauses. (<a href="https://redirect.github.com/better-auth/better-auth/pull/10859">#10859</a>)</li> </ul> <p>For detailed changes, see <a href="https://github.com/better-auth/better-auth/blob/c50200bfc716cf43f5c29a2dd5766f6485c46aa1/packages/drizzle-adapter/CHANGELOG.md"><code>CHANGELOG</code></a></p> <h2><code>@better-auth/kysely-adapter</code></h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md">better-auth's changelog</a>.</em></p> <blockquote> <h2>1.7.2</h2> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/10875">#10875</a> <a href="https://github.com/better-auth/better-auth/commit/d5d889bfd8708601d8f27526d35fb9568450b51e"><code>d5d889b</code></a> Thanks <a href="https://github.com/bytaesu"><code>@bytaesu</code></a>! - Fix programmatic migrations failing on Cloudflare D1 while preserving existing-index validation across supported databases.</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/10982">#10982</a> <a href="https://github.com/better-auth/better-auth/commit/b4ad5a110ca4f2e043c0f23a8e5f87e0b31c3fc6"><code>b4ad5a1</code></a> Thanks <a href="https://github.com/bytaesu"><code>@bytaesu</code></a>! - Built-in placeholder emails now consistently use the namespaced <code>{identifier}@{namespace}.placeholder.invalid</code> format.</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/10934">#10934</a> <a href="https://github.com/better-auth/better-auth/commit/c7a5c1a7ed65a5169e98bd347df91b16bb394692"><code>c7a5c1a</code></a> Thanks <a href="https://github.com/bytaesu"><code>@bytaesu</code></a>! - Cookie-cache reads now warn when signed session data is invalid instead of silently appearing as a signed-out session.</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/10879">#10879</a> <a href="https://github.com/better-auth/better-auth/commit/78f0c3922c273de29bd0b77213fbc37cc3b5917e"><code>78f0c39</code></a> Thanks <a href="https://github.com/apps/starslingdev"><code>@starslingdev</code></a>! - Test suites using <code>getTestInstance</code> now run faster because the shared fixture avoids production password-hashing costs by default. Custom <code>emailAndPassword.password</code> implementations continue to take precedence.</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/10823">#10823</a> <a href="https://github.com/better-auth/better-auth/commit/ce8a3ab5442fdd388f3b1346b71292cf617c3146"><code>ce8a3ab</code></a> Thanks <a href="https://github.com/sosyz"><code>@sosyz</code></a>! - Ensure permanently banning a user clears any expiration from a previous temporary ban.</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/10907">#10907</a> <a href="https://github.com/better-auth/better-auth/commit/a021eafaf235dd08c0835d91ee714aca24c4605e"><code>a021eaf</code></a> Thanks <a href="https://github.com/heliohm"><code>@heliohm</code></a>! - A client created with more plugins is again assignable to a client type declaring fewer plugins, as in 1.6.</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/10959">#10959</a> <a href="https://github.com/better-auth/better-auth/commit/c8dcfa57e11e22325dbb2a0cc1af6775f41b1315"><code>c8dcfa5</code></a> Thanks <a href="https://github.com/bytaesu"><code>@bytaesu</code></a>! - Allow same-origin form submissions from pages using <code>Referrer-Policy: no-referrer</code> while continuing to reject untrusted request origins.</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/10979">#10979</a> <a href="https://github.com/better-auth/better-auth/commit/fced1a5d360c14e6358f88dedc9014ff862873f1"><code>fced1a5</code></a> Thanks <a href="https://github.com/bytaesu"><code>@bytaesu</code></a>! - Allow relative callback and redirect URLs to use standard path, query, and fragment syntax while preserving open-redirect protections.</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/10041">#10041</a> <a href="https://github.com/better-auth/better-auth/commit/f6891a2d2d4f7ead7e9b13e65316a0cbd88f3fe4"><code>f6891a2</code></a> Thanks <a href="https://github.com/GautamBytes"><code>@GautamBytes</code></a>! - Allow <code>~</code> in relative callback URLs validated by trusted origin checks.</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/10877">#10877</a> <a href="https://github.com/better-auth/better-auth/commit/649818a2969594e58147a2cc08157812ea0b75ef"><code>649818a</code></a> Thanks <a href="https://github.com/bytaesu"><code>@bytaesu</code></a>! - Prevent disabled MyISAM indexes from satisfying migration index checks.</p> </li> <li> <p>Updated dependencies [<a href="https://github.com/better-auth/better-auth/commit/557e19bfad0f2d2842903ddb1e768a0506aceaea"><code>557e19b</code></a>, <a href="https://github.com/better-auth/better-auth/commit/64da15b0b1ca078d80f115ee0a5bd9ad4ca4d64e"><code>64da15b</code></a>, <a href="https://github.com/better-auth/better-auth/commit/d5d889bfd8708601d8f27526d35fb9568450b51e"><code>d5d889b</code></a>, <a href="https://github.com/better-auth/better-auth/commit/b4ad5a110ca4f2e043c0f23a8e5f87e0b31c3fc6"><code>b4ad5a1</code></a>, <a href="https://github.com/better-auth/better-auth/commit/ea77118d4e00f69ddffed4fb42dfedc08594ea9e"><code>ea77118</code></a>, <a href="https://github.com/better-auth/better-auth/commit/5aea9f77284dfb7b187e8e7bec0cebd4b8834123"><code>5aea9f7</code></a>, <a href="https://github.com/better-auth/better-auth/commit/fced1a5d360c14e6358f88dedc9014ff862873f1"><code>fced1a5</code></a>, <a href="https://github.com/better-auth/better-auth/commit/e1d40116e2b6a797372ac82b9feea39f57285632"><code>e1d4011</code></a>]:</p> <ul> <li><code>@better-auth/core</code><a href="https://github.com/1"><code>@1</code></a>.7.2</li> <li><code>@better-auth/kysely-adapter</code><a href="https://github.com/1"><code>@1</code></a>.7.2</li> <li><code>@better-auth/drizzle-adapter</code><a href="https://github.com/1"><code>@1</code></a>.7.2</li> <li><code>@better-auth/memory-adapter</code><a href="https://github.com/1"><code>@1</code></a>.7.2</li> <li><code>@better-auth/mongo-adapter</code><a href="https://github.com/1"><code>@1</code></a>.7.2</li> <li><code>@better-auth/prisma-adapter</code><a href="https://github.com/1"><code>@1</code></a>.7.2</li> <li><code>@better-auth/telemetry</code><a href="https://github.com/1"><code>@1</code></a>.7.2</li> </ul> </li> </ul> <h2>1.7.1</h2> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/10863">#10863</a> <a href="https://github.com/better-auth/better-auth/commit/845bbd1de682ab87e03ce925f85087da81249a4e"><code>845bbd1</code></a> Thanks <a href="https://github.com/gustavovalverde"><code>@gustavovalverde</code></a>! - <code>auth migrate</code> no longer attempts to add a required column with no default value to a table that already has rows. It stops with an error naming the column and the backfill to run first. Previously the generated statement failed on SQLite, Postgres, and SQL Server; on MySQL it filled the new column with an empty string for every existing row and reported success. If <code>auth migrate</code> already ran against a MySQL database on 1.7, run the check in the upgrade guide's account identity section.</p> <p><code>getMigrations</code> throws the new <code>UnsafeMigrationError</code> (exported from <code>better-auth/db/migration</code>) for this refusal, so callers can distinguish it from other migration errors such as an index-definition conflict.</p> <p><code>auth generate</code> still emits the statements for external migration tooling, with a comment banner naming any column that needs a manual backfill first.</p> <p>A required field whose database column is still nullable logs a warning instead of blocking the migration.</p> <p>A CLI command that fails now prints its error and exits with a non-zero code instead of an unhandled promise rejection.</p> </li> <li> <p>Updated dependencies []:</p> <ul> <li><code>@better-auth/core</code><a href="https://github.com/1"><code>@1</code></a>.7.1</li> <li><code>@better-auth/drizzle-adapter</code><a href="https://github.com/1"><code>@1</code></a>.7.1</li> </ul> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/better-auth/better-auth/commit/ba12fcdfa774ca27d417079dbac0b1b5894ccaf2"><code>ba12fcd</code></a> chore: release v1.7.2 (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10870">#10870</a>)</li> <li><a href="https://github.com/better-auth/better-auth/commit/79904f0be8fadb939743e90a61bbfee207c152e1"><code>79904f0</code></a> fix(origin-check): support fragments in relative redirect URLs (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10983">#10983</a>)</li> <li><a href="https://github.com/better-auth/better-auth/commit/c8dcfa57e11e22325dbb2a0cc1af6775f41b1315"><code>c8dcfa5</code></a> fix(origin-check): validate null origins using fetch metadata (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10959">#10959</a>)</li> <li><a href="https://github.com/better-auth/better-auth/commit/e1d40116e2b6a797372ac82b9feea39f57285632"><code>e1d4011</code></a> fix(logger): respect configured logger in auth request context (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10939">#10939</a>)</li> <li><a href="https://github.com/better-auth/better-auth/commit/557e19bfad0f2d2842903ddb1e768a0506aceaea"><code>557e19b</code></a> refactor(context): clarify auth endpoint context access (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10938">#10938</a>)</li> <li><a href="https://github.com/better-auth/better-auth/commit/b4ad5a110ca4f2e043c0f23a8e5f87e0b31c3fc6"><code>b4ad5a1</code></a> refactor: centralize placeholder email generation (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10982">#10982</a>)</li> <li><a href="https://github.com/better-auth/better-auth/commit/fced1a5d360c14e6358f88dedc9014ff862873f1"><code>fced1a5</code></a> fix(origin-check): improve relative callback URL validation (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10979">#10979</a>)</li> <li><a href="https://github.com/better-auth/better-auth/commit/f6891a2d2d4f7ead7e9b13e65316a0cbd88f3fe4"><code>f6891a2</code></a> fix(origin-check): allow tilde in relative callback URLs (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10041">#10041</a>)</li> <li><a href="https://github.com/better-auth/better-auth/commit/ce8a3ab5442fdd388f3b1346b71292cf617c3146"><code>ce8a3ab</code></a> fix(admin): ban without a duration should clear the previous expiration (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10823">#10823</a>)</li> <li><a href="https://github.com/better-auth/better-auth/commit/a021eafaf235dd08c0835d91ee714aca24c4605e"><code>a021eaf</code></a> fix(client): a client with more plugins fits a narrower client type again (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/1">#1</a>...</li> <li>Additional commits viewable in <a href="https://github.com/better-auth/better-auth/commits/v1.7.2/packages/better-auth">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
eb7b4d1371 |
chore(deps): bump @aws-sdk/client-s3 from 3.1115.0 to 3.1120.0 (#12567)
Bumps [@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3) from 3.1115.0 to 3.1120.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/aws/aws-sdk-js-v3/releases">@aws-sdk/client-s3's releases</a>.</em></p> <blockquote> <h2>v3.1120.0</h2> <h4>3.1120.0(2026-08-27)</h4> <h5>Documentation Changes</h5> <ul> <li><strong>client-opensearch:</strong> Updating SDK and CLI documentation for AttachDataSource API. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/d696fe7602bb2f5c022a2a850767b2284b85d64a">d696fe76</a>)</li> </ul> <h5>New Features</h5> <ul> <li><strong>client-lambda-microvms:</strong> Added InsufficientCapacityException to RunMicrovm for capacity-related failures. Added lifecycle status field (AVAILABLE, DEPRECATED) to ListManagedMicrovmImageVersions. Added ConflictException to CreateMicrovmAuthToken and CreateMicrovmShellAuthToken for unregistered MicroVMs. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/72a8ff80923f172e73030a0b28d9946fb16d0ffa">72a8ff80</a>)</li> <li><strong>client-codedeploy:</strong> Added a deploymentMode parameter to CreateDeployment. Set it to RESTART to restart an EC2 and on-premises fleet, using the last successful revision, honoring Deployment Configuration. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/78d4f9640b6a9fe509f5a466cfa821052f76a614">78d4f964</a>)</li> <li><strong>client-cloudwatch-logs:</strong> Added resultCount to QueryStatistics in GetQueryResults. This field returns the total number of output rows in the final result set, helping customers programmatically determine whether a query produced results after all operations including post-aggregation filters. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/0e4d242b71b24dc7305d6a3b7356e052bd969e67">0e4d242b</a>)</li> <li><strong>client-datazone:</strong> Add cascadeDelete to DeleteDomain. When specified, DataZone recursively deletes all projects, environments, subscriptions, and their underlying AWS resources before removing the domain. Deletion progress is reported via deleteProgress and resource failures via failureReasons on GetDomain. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/3a74dc4b94d54616c93dabef996e6680c2ef1edb">3a74dc4b</a>)</li> <li><strong>client-rds:</strong> Adding support for the full snapshot size, in bytes, of DB instance snapshots. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/ab2f66f5f52d48690e0e914fb1cf52c290837ec5">ab2f66f5</a>)</li> <li><strong>client-ec2:</strong> EC2 allows AMI owners to define compatible instance types on their AMIs, blocking RunInstances calls automatically for launches on non-permitted instance types. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/311b3b26dbad32a32a94713fca4ffb65eaf2ec61">311b3b26</a>)</li> <li><strong>client-cognito-identity-provider:</strong> Adds the AdminDeleteSoftwareToken API operation, enabling administrators to remove a user's registered TOTP (software token) MFA configuration from a user pool. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/f661bebc4db63a4cea2e02b2ec722e82e4908425">f661bebc</a>)</li> </ul> <hr /> <p>For list of updated packages, view <strong>updated-packages.md</strong> in <strong>assets-3.1120.0.zip</strong></p> <h2>v3.1119.0</h2> <h4>3.1119.0(2026-08-26)</h4> <h5>Chores</h5> <ul> <li><strong>codegen:</strong> smithy-aws-typescript-codegen 0.53.0 (<a href="https://redirect.github.com/aws/aws-sdk-js-v3/pull/8276">#8276</a>) (<a href="https://github.com/aws/aws-sdk-js-v3/commit/dffb383bdc2ebc39a18c0dfe7494215a7783ff04">dffb383b</a>)</li> </ul> <h5>New Features</h5> <ul> <li><strong>client-sagemaker:</strong> Amazon SageMaker AI now supports ml.g7 instances for model optimization. You can now run model optimization jobs on ml.g7 instances, in supported AWS Regions. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/6d5e106634bcc6f63cf148bb3339a64f3d5c0404">6d5e1066</a>)</li> <li><strong>client-devops-agent:</strong> AWS DevOps Agent now supports trigger filter groups for Release Readiness Review, letting you control when the capability auto-triggers based on webhook events and target branches. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/bc3d53d55006d95d34928b8044289a080f3fe512">bc3d53d5</a>)</li> <li><strong>client-license-manager-user-subscriptions:</strong> Released support for License Expiry field in ListProductSubscriptions API (<a href="https://github.com/aws/aws-sdk-js-v3/commit/454d7f7ffbfe044a534ac3f874c108e4eae1739e">454d7f7f</a>)</li> <li><strong>client-ec2:</strong> Adds deleting state to possible VPC States. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/43091d55b3ca5ef039506afdcbd9c293162c61f3">43091d55</a>)</li> <li><strong>client-network-firewall:</strong> Adding new status enum for Firewalls. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/4cb21cb3b82b7dbb9bdad31694d084e517f8047a">4cb21cb3</a>)</li> </ul> <hr /> <p>For list of updated packages, view <strong>updated-packages.md</strong> in <strong>assets-3.1119.0.zip</strong></p> <h2>v3.1118.0</h2> <h4>3.1118.0(2026-08-25)</h4> <h5>Documentation Changes</h5> <ul> <li><strong>client-marketplace-metering:</strong> Updated documentation to clarify duplicate-billing prevention and BatchMeterUsage retry guidance (<a href="https://github.com/aws/aws-sdk-js-v3/commit/322310259e52948dc826a3ad3f3e95544df95fcc">32231025</a>)</li> </ul> <h5>New Features</h5> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md">@aws-sdk/client-s3's changelog</a>.</em></p> <blockquote> <h1><a href="https://github.com/aws/aws-sdk-js-v3/compare/v3.1119.0...v3.1120.0">3.1120.0</a> (2026-08-27)</h1> <p><strong>Note:</strong> Version bump only for package <code>@aws-sdk/client-s3</code></p> <h1><a href="https://github.com/aws/aws-sdk-js-v3/compare/v3.1118.0...v3.1119.0">3.1119.0</a> (2026-08-26)</h1> <p><strong>Note:</strong> Version bump only for package <code>@aws-sdk/client-s3</code></p> <h1><a href="https://github.com/aws/aws-sdk-js-v3/compare/v3.1117.0...v3.1118.0">3.1118.0</a> (2026-08-25)</h1> <p><strong>Note:</strong> Version bump only for package <code>@aws-sdk/client-s3</code></p> <h1><a href="https://github.com/aws/aws-sdk-js-v3/compare/v3.1116.0...v3.1117.0">3.1117.0</a> (2026-08-24)</h1> <p><strong>Note:</strong> Version bump only for package <code>@aws-sdk/client-s3</code></p> <h1><a href="https://github.com/aws/aws-sdk-js-v3/compare/v3.1115.0...v3.1116.0">3.1116.0</a> (2026-08-21)</h1> <p><strong>Note:</strong> Version bump only for package <code>@aws-sdk/client-s3</code></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/aws/aws-sdk-js-v3/commit/d6be6f8dd3ee8d43fd70dfb5b52a977ce251c720"><code>d6be6f8</code></a> Publish v3.1120.0</li> <li><a href="https://github.com/aws/aws-sdk-js-v3/commit/ba4e4498a7610ec0b5ad7af195db137f618e09bc"><code>ba4e449</code></a> Publish v3.1119.0</li> <li><a href="https://github.com/aws/aws-sdk-js-v3/commit/c65dd6533de52787da39c1bc58177b4258a044ea"><code>c65dd65</code></a> Publish v3.1118.0</li> <li><a href="https://github.com/aws/aws-sdk-js-v3/commit/78b069ac777c0b3e8cca25aff07efc551ab59608"><code>78b069a</code></a> Publish v3.1117.0</li> <li><a href="https://github.com/aws/aws-sdk-js-v3/commit/d760a00859a08b5d04590ee047510b49add12361"><code>d760a00</code></a> Publish v3.1116.0</li> <li><a href="https://github.com/aws/aws-sdk-js-v3/commit/8369ada75d60056e24e1ee8bca20f16ce2faea93"><code>8369ada</code></a> chore(codegen): update to sync with the latest smithy-ts (<a href="https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3/issues/8272">#8272</a>)</li> <li>See full diff in <a href="https://github.com/aws/aws-sdk-js-v3/commits/v3.1120.0/clients/client-s3">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
DottaandPaperclip
|
8610e7934e |
fix(release): bundle vendored runner ACPX runtime (#12582)
## Thinking Path > - Paperclip is the open source app that people use to manage AI agents for work. > - The npm release includes the Paperclip server and a vendored runner. > - The vendored runner imports ACPX when it starts a Codex agent. > - The server package did not include the ACPX version that the runner needs. > - A fresh canary install therefore stopped with `ERR_MODULE_NOT_FOUND` after onboarding. > - This pull request bundles the patched ACPX runtime with the server package. > - The benefit is that a fresh npm install can load the vendored runner. ## Linked Issues or Issue Description No public issue exists for this bug. A GitHub search found no duplicate or related pull request. **What happened?** A fresh `npx paperclipai@canary onboard` command completed onboarding. The server then failed to start. Node could not resolve `acpx` from the vendored Paperclip runner. **Expected behavior** The server should start after onboarding from a fresh npm cache and a temporary data directory. **Steps to reproduce** 1. Run `npx paperclipai@canary onboard --data-dir "$(mktemp -d /tmp/paperclip-canary.XXXXXX)"`. 2. Select Quickstart. 3. Start Paperclip. 4. Observe `ERR_MODULE_NOT_FOUND` for `acpx`. **Paperclip version or commit** `paperclipai@2026.831.0-canary.6` **Deployment mode** Other: local trusted Quickstart through `npx`. **Installation method** npm through `npx`. **Agent adapter(s) involved** Codex. **Database mode** Embedded PGlite. **Access context** Board operator during onboarding. **Node.js version** Node.js 26.4.0. **Operating system** macOS. **Relevant logs or output** ```shell Cannot find package 'acpx' imported from .../node_modules/@paperclipai/server/dist/vendor/paperclip-runner/drivers/acpx/codex-runtime-adapter.js ``` **Relevant config (if applicable)** No custom configuration was required. **Additional context** The published adapter utilities contain a nested `acpx@0.12.0`. Node cannot resolve that nested package from the sibling vendored runner. Installing `acpx@0.13.1` at the clean package root makes the failing runner import succeed. **Privacy checklist** The log excerpt contains no user path, token, company name, or other private value. ## What Changed - Added `acpx@0.13.1` as a bundled server runtime dependency. - Added a version-specific patch check for the ACPX versions used by the server and adapter utilities. - Added release-package coverage for the server ACPX bundle. ## Verification - `pnpm test:release-registry` passed 98 tests. - `node --test scripts/acpx-patch-packaging.test.mjs` passed 12 tests. - `pnpm exec vitest run server/src/__tests__/server-package-build-script.test.ts` passed 4 tests. - `node --test scripts/release-package-map.test.mjs` passed 12 tests. - `pnpm -r typecheck` passed. - A clean extracted server tarball contained the patched `acpx@0.13.1` runtime. - The previously failing vendored runner module imported from that clean tarball. - The repository-wide test suite was stopped before completion at the maintainer's request because it takes too long for this urgent packaging fix. ## Risks - Risk is low. - The server tarball grows because it now contains ACPX and its production dependencies. - The release stager now uses a version-specific marker to verify the ACPX patch. > For core feature work, check [`ROADMAP.md`](ROADMAP.md) first and discuss it in `#dev` before opening the PR. Feature PRs that overlap with planned core work may need to be redirected — check the roadmap first. See `CONTRIBUTING.md`. ## Model Used - OpenAI Codex with `gpt-5.6-sol`. - The model used reasoning mode, tool use, and code execution. - The context window size was not disclosed. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [ ] All Paperclip CI gates are green - [ ] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge Co-authored-by: Paperclip <noreply@paperclip.ing> |
||
|
Dotta
|
d387cc0ff0 |
feat(connections): add managed external MCP connectors (#12346)
## Thinking Path > - Paperclip is the open source app people use to manage AI agents for work. > - Connection intents need secure provider implementations to complete setup. > - Some providers use managed OAuth or external credential brokers. > - Those tokens must stay out of durable Paperclip state and fail closed when refresh fails. > - This pull request adds managed connector backends and the required storage contract. > - The benefit is safer provider setup with governed credential lifecycles. ## Linked Issues or Issue Description Refs #11965 This is stack 8 of 11. It depends on stack 7 and replaces another reviewable part of #11965. ## What Changed - Add managed Google Workspace and external connector backends. - Add Vercel Connect support without storing provider bearer tokens. - Add replay-safe migration 0232 and its generated snapshot. - Fail closed and clear stale token bindings when organization OAuth refresh needs reauthorization. ## Verification - `pnpm --filter @paperclipai/server typecheck` - `pnpm --filter @paperclipai/server exec vitest run src/__tests__/tool-access-service.test.ts` - Result: 194 tests passed. - `pnpm --filter @paperclipai/db check:migrations` - `pnpm build` - `pnpm exec vitest run --project @paperclipai/server server/src/services/remote-url-credentials.test.ts` (5 passed, including URL userinfo vault extraction) ## Risks - Broker metadata errors can block provider setup. - OAuth refresh failure disables the shared organization connection until reauthorization. - Migration 0232 is generated, ordered after 0231, and safe to replay. > I checked `ROADMAP.md`. This stack continues the existing app connection work from #11965 and does not duplicate another planned item. ## Model Used OpenAI Codex, GPT-5. The runtime model ID and context window were not exposed. The model used reasoning, tool use, and code execution. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have linked the public source pull request with `Refs #` - [x] I have not referenced internal or instance-local Paperclip issues or links - [x] My branch name describes the change and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge |
||
|
Nicky LeachandPaperclip
|
1de105c475 |
fix(observability): pin the Sentry browser SDK and gate the optional Sentry server peer on the exact version (#12270)
## Thinking Path
> - Paperclip is the open source app people use to manage AI agents for
work.
> - Paperclip uses separate server and browser packages for runtime
services and the board.
> - Sentry integrations need an exact SDK version and safe optional
loading.
> - A version range can select an SDK that the privacy tests did not
audit.
> - Missing peer metadata does not describe the optional server SDK
contract.
> - This pull request pins the browser SDK and gates the optional server
SDK on its exact version.
> - The benefit is a clear SDK contract with fail-open startup behavior.
## Linked Issues or Issue Description
**What happened?**
The browser package used the range ^10.71.0, so a lockfile refresh could
select a newer SDK. The server loaded @sentry/node dynamically but did
not declare its optional peer contract.
**Expected behavior**
The browser package must use the audited 10.71.0 version. The server
must load @sentry/node only when the installed peer matches 10.71.0. The
server must start when the optional peer is absent.
**Steps to reproduce**
1. Install the project dependencies.
2. Inspect the browser Sentry version and the server package metadata.
3. Start the server without installing @sentry/node.
4. Confirm that the server starts and that the dynamic Sentry bootstrap
does not load an unsupported peer version.
**Paperclip version or commit**
|
||
|
Nicky LeachandPaperclip
|
06cd21ed0f |
fix(observability): declare the optional OpenTelemetry peer dependencies (#12249)
## Thinking Path > - Paperclip manages AI agents for work. > - Paperclip includes an observability path that operators can enable for tracing. > - The server loads several OpenTelemetry packages only when tracing is enabled. > - The documentation calls these packages optional peer dependencies, but the server manifest does not declare them. > - This gap hides supported versions and stops Dependabot from maintaining the packages. > - This pull request aligns package metadata, runtime checks, and documentation with the opt-in tracing design. > - The change gives operators clear installation behavior and keeps the no-op default. ## Linked Issues or Issue Description This pull request fixes a package metadata and installation defect. Related observability work appears in [#8476](https://github.com/paperclipai/paperclip/pull/8476) and [#9672](https://github.com/paperclipai/paperclip/pull/9672). The server documentation described optional OpenTelemetry peer dependencies, but `server/package.json` did not declare them. Package managers and Dependabot could not see the supported version ranges. The UI and Claude local adapter also relied on automatic peer installation for `yjs` and `@anthropic-ai/sdk`. The package manifests now declare the optional runtime packages. A default install does not install optional tracing peers. The server keeps its no-op behavior when tracing is disabled or a peer is absent. ## What Changed - Add seven optional OpenTelemetry packages to `server/package.json` and mark each package as optional. - Keep `@opentelemetry/api` as a normal dependency for the no-op interface. - Disable automatic peer installation in `.npmrc`. - Declare `yjs` for the UI package and `@anthropic-ai/sdk` for the Claude local adapter. - Check declared peer versions before the server loads a dynamic OpenTelemetry import. - Keep the endpoint gate, dynamic imports, and fail-open behavior unchanged. - Update the observability and README documentation. - Tell Dependabot that its npm parser does not read `peerDependencies`. ## Verification - Targeted server tests pass: 34 passed and 2 skipped. - The skipped tests require the real OpenTelemetry SDK and remain pre-existing. - The pull request workflow regenerates the lockfile because manifest files and `.npmrc` changed. - The policy job confirms that the pull request does not include `pnpm-lock.yaml`. - GitHub checks pass except `security/snyk (cryppadotta)`, which remains pending after its authorized wait cap. - Greptile Review reports 5/5 with no open findings. - Server typecheck passes. ## Risks - Optional peers can produce a diagnostic when the installed version does not match the declared range. - A missing optional peer does not stop the server. - Disabling automatic peer installation can expose undeclared package use in other workspaces. - This pull request declares the affected packages and adds tests for the changed behavior. - This pull request makes no database or API changes. ## Model Used OpenAI Codex, GPT-5, with repository inspection and pull request preparation. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with Fixes / Closes / Refs OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links - [x] My branch name describes the change and contains no internal Paperclip ticket id - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Paperclip <noreply@paperclip.ing> |
||
|
|
0cedb45df3 |
build(deps-dev): bump typescript from 5.9.3 to 7.0.2 (#11880)
Bumps [typescript](https://github.com/microsoft/TypeScript) from 5.9.3 to 7.0.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/microsoft/TypeScript/releases">typescript's releases</a>.</em></p> <blockquote> <h2>TypeScript 7.0.2</h2> <p><a href="https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/">https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/</a></p> <p>This tag was originally released at: <a href="https://github.com/microsoft/typescript-go/releases/tag/typescript%2Fv7.0.2">https://github.com/microsoft/typescript-go/releases/tag/typescript%2Fv7.0.2</a></p> <h2>TypeScript 6.0.3</h2> <p>For release notes, check out the <a href="https://devblogs.microsoft.com/typescript/announcing-typescript-6-0/">release announcement blog post</a>.</p> <ul> <li><a href="https://github.com/Microsoft/TypeScript/issues?utf8=%E2%9C%93&q=milestone%3A%22TypeScript+6.0.0%22">fixed issues query for TypeScript 6.0.0 (Beta)</a>.</li> <li><a href="https://github.com/Microsoft/TypeScript/issues?utf8=%E2%9C%93&q=milestone%3A%22TypeScript+6.0.1%22">fixed issues query for TypeScript 6.0.1 (RC)</a>.</li> <li><a href="https://github.com/Microsoft/TypeScript/issues?utf8=%E2%9C%93&q=milestone%3A%22TypeScript+6.0.2%22">fixed issues query for TypeScript 6.0.2 (Stable)</a>.</li> <li><a href="https://github.com/Microsoft/TypeScript/issues?utf8=%E2%9C%93&q=milestone%3A%22TypeScript+6.0.3%22">fixed issues query for TypeScript 6.0.3 (Stable)</a>.</li> </ul> <p>Downloads are available on:</p> <ul> <li><a href="https://www.npmjs.com/package/typescript">npm</a></li> </ul> <h2>TypeScript 6.0</h2> <p>For release notes, check out the <a href="https://devblogs.microsoft.com/typescript/announcing-typescript-6-0/">release announcement blog post</a>.</p> <ul> <li><a href="https://github.com/Microsoft/TypeScript/issues?utf8=%E2%9C%93&q=milestone%3A%22TypeScript+6.0.0%22">fixed issues query for TypeScript 6.0.0 (Beta)</a>.</li> <li><a href="https://github.com/Microsoft/TypeScript/issues?utf8=%E2%9C%93&q=milestone%3A%22TypeScript+6.0.1%22">fixed issues query for TypeScript 6.0.1 (RC)</a>.</li> <li><a href="https://github.com/Microsoft/TypeScript/issues?utf8=%E2%9C%93&q=milestone%3A%22TypeScript+6.0.2%22">fixed issues query for TypeScript 6.0.2 (Stable)</a>.</li> </ul> <p>Downloads are available on:</p> <ul> <li><a href="https://www.npmjs.com/package/typescript">npm</a></li> </ul> <h2>TypeScript 6.0.1 RC</h2> <p>For release notes, check out the <a href="https://devblogs.microsoft.com/typescript/announcing-typescript-6-0-rc/">release announcement blog post</a>.</p> <ul> <li><a href="https://github.com/Microsoft/TypeScript/issues?utf8=%E2%9C%93&q=milestone%3A%22TypeScript+6.0.0%22">fixed issues query for TypeScript 6.0.0 (Beta)</a>.</li> <li><a href="https://github.com/Microsoft/TypeScript/issues?utf8=%E2%9C%93&q=milestone%3A%22TypeScript+6.0.1%22">fixed issues query for TypeScript 6.0.1 (RC)</a>.</li> </ul> <p>Downloads are available on:</p> <ul> <li><a href="https://www.npmjs.com/package/typescript">npm</a></li> </ul> <h2>TypeScript 6.0 Beta</h2> <p>For release notes, check out the <a href="https://devblogs.microsoft.com/typescript/announcing-typescript-6-0-beta/">release announcement</a>.</p> <ul> <li><a href="https://github.com/Microsoft/TypeScript/issues?utf8=%E2%9C%93&q=milestone%3A%22TypeScript+6.0.0%22+is%3Aclosed+">fixed issues query for Typescript 6.0.0 (Beta)</a>.</li> </ul> <p>Downloads are available on:</p> <ul> <li><a href="https://www.npmjs.com/package/typescript">npm</a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/microsoft/TypeScript/commit/1e4744d68260a7cb91b62b12edc3f6a2187faaf1"><code>1e4744d</code></a> Merge branch 'main' into ts7-release</li> <li><a href="https://github.com/microsoft/TypeScript/commit/a5a219c3b5da0db4fa0ecf6c0b1f588c9af9c669"><code>a5a219c</code></a><code>microsoft/typescript-go#4558</code></li> <li><a href="https://github.com/microsoft/TypeScript/commit/ecfe30dce91368d52c9a49b6095bb0b673a238f8"><code>ecfe30d</code></a> Update status localization</li> <li><a href="https://github.com/microsoft/TypeScript/commit/5de25b5f8fec2ca35eadaed041f1f06d2e214895"><code>5de25b5</code></a> Hide executable name in TypeScript status</li> <li><a href="https://github.com/microsoft/TypeScript/commit/d7ce74a75da2b80e8201506a1599c06549432b93"><code>d7ce74a</code></a> Show bundled TypeScript version for packaged servers</li> <li><a href="https://github.com/microsoft/TypeScript/commit/29be66a607707f90d7a53103a4469bb3015a4d54"><code>29be66a</code></a> Correct TS 7 release version to 7.0.2</li> <li><a href="https://github.com/microsoft/TypeScript/commit/ed2bd1bfa4aac5211ce4bc58fcd1313c7eddc8ff"><code>ed2bd1b</code></a> Merge branch 'main' into ts7-release</li> <li><a href="https://github.com/microsoft/TypeScript/commit/887307575c58ea640dbeba3b4e8fdb6347cd3044"><code>8873075</code></a> Bump the github-actions group across 1 directory with 3 updates (microsoft/ty...</li> <li><a href="https://github.com/microsoft/TypeScript/commit/9427131ae2d4e230a90ee8a09daac4e75da3e311"><code>9427131</code></a> Set up stable / nightly extension split, other prep (microsoft/typescript-go#...</li> <li><a href="https://github.com/microsoft/TypeScript/commit/d4eaca5460a1f5f02a829e62706794b0a6fb903e"><code>d4eaca5</code></a><code>microsoft/typescript-go#4549</code></li> <li>Additional commits viewable in <a href="https://github.com/microsoft/TypeScript/compare/v5.9.3...v7.0.2">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~microsoft1es">microsoft1es</a>, a new releaser for typescript since your current version.</p> </details> <br /> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Priya Raman <priya@paperclip.ing> Co-authored-by: Paperclip <noreply@paperclip.ing> |
||
|
Dotta
|
9964b034bb |
feat(runner): add hidden server PRP coordinator (#12176)
## Thinking Path > - Paperclip is the open source app people use to manage AI agents for work. > - The Paperclip Runner needs a narrow server trust boundary before an adapter can start it. > - The package has durable runner transport, but the server does not host or authorize that transport. > - Native persistence exists, but no writer connects PRP events to those records. > - A direct adapter must not enter this path by accident. > - This pull request adds a hidden, run-bound PRP server coordinator. > - The benefit is a recoverable server boundary that remains unavailable to normal execution. ## Linked Issues or Issue Description Refs #11962 Refs #12129 Refs #12169 **Subsystem affected** Cross-cutting. The change affects the runner package and server orchestration. **Problem or motivation** The server cannot authenticate runnerd, commit PRP events before ACK, authorize semantic tools, or enter native finalization from a durable runner result. The application must have this hidden boundary before a guarded adapter can use the runner. **Proposed solution** Add an authenticated PRP WebSocket authority and register it only for one exact persisted native Codex run. Bind each connection and event to the company, issue, agent, run, runner, session, turn, item, and verified runner identity. Commit each event before its cumulative ACK. Project only authorized same-task read tools. Rebuild the accepted result and finalization record from durable result and terminal events. **Alternatives considered** The server could expose a broad runner API key or route semantic calls through existing adapter endpoints. Those options grant too much authority and weaken replay recovery. The server could also add the user-facing adapter in this pull request. That option would mix rollout selection with the transport trust boundary and make legacy compatibility harder to review. **Roadmap alignment** This work supports the shipped enforced-outcomes, governed-tool, and self-healing-run milestones. It does not add a new roadmap surface. ## What Changed - Add the durable PRP server authority with one-use bootstrap tickets, reconnect leases, encrypted frames, bounded state, cumulative ACKs, and idempotent commands. - Add `/api/runner/v1/connect/:runId`. Derive its `ws://` or `wss://` URL from the configured Paperclip API URL. - Register one authority only after the coordinator verifies the complete native Codex run binding. - Commit validated PRP events to `heartbeat_run_events` before ACK. Reject source gaps and conflicting replays. - Rebuild accepted results and finalization records from durable result and terminal events. Enforce finalization owner leases and retry times. - Project five same-task read operations. Recheck run, agent, task, and company authority for each call. - Keep the route hidden. No adapter selects this coordinator, and no code starts runnerd. - Vendor the compiled runner TypeScript runtime into the server package while keeping the workspace package development-only for the server. - Document the package, database writer, run-log payload, and credential exclusions. ## Verification - Run `pnpm --filter @paperclipai/paperclip-runner check:all`. All TypeScript protocol checks and 69 Vitest tests pass, including commit-before-ACK crash recovery. All 43 Rust unit tests and 13 Rust integration tests pass. Conformance and replay parity pass. - Run the focused server WebSocket, coordinator, package-build, and startup-wiring suites. All 26 tests pass, including a clean-checkout reproduction with the runner `dist` directory absent. - Run `pnpm -r typecheck`. - Run `pnpm test:run`. - Run `pnpm build`. - Confirm that the diff contains 19 files. Confirm that it contains no workflow or `pnpm-lock.yaml` change. ## Risks - The server installs the WebSocket route at startup. An unregistered or malformed run path fails closed and creates no native record. - Bootstrap tickets are one use. The private state directory uses mode `0700`, and the state file uses mode `0600`. The file stores derived authentication verifiers and never stores raw tickets or lease tokens. - The journal has explicit frame, command, event-window, and file-size bounds. A bound violation closes the runner connection or rejects the command. - A runner event reaches the database before its ACK. A crash between event commit and ACK causes a byte-equivalent replay, not a second logical effect. - The coordinator accepts only an existing queued or running native Codex row with exact company, task, agent, runner, session, and completion-contract ownership. - Existing direct adapters do not call this service. They keep their current execution, transcript, result, and finalization paths. - The server has no production dependency on the private runner package. Its build copies the compiled runtime into `server/dist`; the workspace link is development-only. This adds no external package and does not change the lockfile. > For core feature work, check [`ROADMAP.md`](ROADMAP.md) first and discuss it in `#dev` before opening the PR. Feature PRs that overlap with planned core work may need to be redirected — check the roadmap first. See `CONTRIBUTING.md`. ## Model Used - OpenAI Codex with GPT-5. The exact deployment ID and context-window size are not exposed. The model used agentic reasoning, repository tools, code execution, and test execution. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge |
||
|
dependabot[bot]
|
69e8585146 |
build(deps): bump better-auth from 1.6.28 to 1.7.0 (#11886)
Bumps [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) from 1.6.28 to 1.7.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/better-auth/better-auth/releases">better-auth's releases</a>.</em></p> <blockquote> <h2>v1.7.0</h2> <p><strong>Blog post:</strong> <a href="https://better-auth.com/blog/1-7">Better Auth 1.7</a></p> <h2><code>better-auth</code></h2> <h3>❗ Breaking Changes</h3> <ul> <li>Moved database joins out of <code>experimental</code> into the stable <code>advanced.database.joins</code> option (<a href="https://redirect.github.com/better-auth/better-auth/pull/10359">#10359</a>) <blockquote> <p><strong>Migration:</strong> Replace <code>experimental: { joins: true }</code> with <code>advanced: { database: { joins: true } }</code>. Drizzle and Prisma users should regenerate their schema (<code>npx auth@latest generate</code>) so it includes the required relations.</p> </blockquote> </li> <li>Scoped account identity by trusted issuer, keying accounts on <code>(issuer, accountId)</code> (<a href="https://redirect.github.com/better-auth/better-auth/pull/10403">#10403</a>) <blockquote> <p><strong>Migration:</strong> Accounts now require <code>Account.issuer</code>. Read provider identity from <code>accountInfo.account.accountId</code>, drop <code>mapping.id</code> from SSO configs, and give the <code>microsoftEntraId</code> helper a concrete tenant GUID. Apply the account-identity backfill in the 1.7 upgrade guide before deploying.</p> </blockquote> </li> <li>Required captcha endpoint entries to match full auth paths, with wildcard support (<a href="https://redirect.github.com/better-auth/better-auth/pull/10004">#10004</a>) <blockquote> <p><strong>Migration:</strong> Replace partial paths such as <code>/sign-in</code> with explicit wildcards like <code>/sign-in/*</code> or <code>/sign-in/**</code>.</p> </blockquote> </li> <li>Moved the MCP plugin into its own <code>@better-auth/mcp</code> package built on the OAuth provider (<a href="https://redirect.github.com/better-auth/better-auth/pull/9992">#9992</a>) <blockquote> <p><strong>Migration:</strong> Install <code>@better-auth/mcp</code> and <code>@better-auth/cimd</code>, add the now-required <code>jwt()</code> plugin, and move options nested under <code>oidcConfig</code> to flat <code>mcp({ ... })</code> options. Rename <code>withMcpAuth</code> to <code>requireMcpAuth</code> and <code>mcpHandler</code> to <code>createMcpProtectedRequestHandler</code>. Regenerate the schema (<code>npx auth migrate</code>): <code>oauthApplication</code> becomes <code>oauthClient</code>, plus new <code>oauthRefreshToken</code> and <code>oauthClientAssertion</code> tables.</p> </blockquote> </li> <li>Added OIDC back-channel logout so ending a session cuts off every connected app's API access (<a href="https://redirect.github.com/better-auth/better-auth/pull/9304">#9304</a>) <blockquote> <p><strong>Migration:</strong> Introspecting an access token whose session has ended now returns <code>{ active: false }</code>, and <code>/oauth2/userinfo</code> rejects it. Clients opt into notifications by registering <code>backchannel_logout_uri</code>. Run the schema migration for the new <code>oauthClient</code> and <code>oauthAccessToken</code> columns.</p> </blockquote> </li> <li>Modeled OAuth protected resources explicitly, with per-resource TTLs, scopes, claims, and signing pins (<a href="https://redirect.github.com/better-auth/better-auth/pull/9648">#9648</a>) <blockquote> <p><strong>Migration:</strong> <code>validAudiences</code> is removed: move each resource identifier into <code>resources</code> and link restricted clients through <code>oauthClientResource</code>. <code>@better-auth/mcp</code> now requires an explicit <code>resource</code>. Run <code>npx @better-auth/cli generate</code> and apply the migration before deploying.</p> </blockquote> </li> <li>Decoupled SCIM provisioning from the organization plugin (<a href="https://redirect.github.com/better-auth/better-auth/pull/10390">#10390</a>) <blockquote> <p><strong>Migration:</strong> SCIM configuration, client APIs, database schema, and the Group model are all replaced, and provisioning state cannot migrate in place. Follow the SCIM cutover in the 1.7 upgrade guide, including a full directory reprovision, before resuming traffic.</p> </blockquote> </li> <li>Added OTP-only two-factor enablement with a discriminated <code>enableTwoFactor</code> response (<a href="https://redirect.github.com/better-auth/better-auth/pull/9057">#9057</a>) <blockquote> <p><strong>Migration:</strong> <code>enableTwoFactor</code> now returns a <code>method</code> field (<code>"otp"</code> or <code>"totp"</code>); narrow on it before reading <code>totpURI</code> and <code>backupCodes</code>. Pass <code>method: "otp"</code> for OTP enrollment, which requires <code>otpOptions.sendOTP</code>.</p> </blockquote> </li> <li>Resolved the auth origin from <code>Host</code> by default when using a dynamic <code>baseURL</code> (<a href="https://redirect.github.com/better-auth/better-auth/pull/9134">#9134</a>) <blockquote> <p><strong>Migration:</strong> If your proxy exposes the public hostname only through <code>x-forwarded-host</code>, set <code>advanced.trustedProxyHeaders: true</code>. Deployments where the proxy rewrites <code>Host</code> (nginx default, Vercel, Cloudflare, Netlify) are unaffected.</p> </blockquote> </li> <li>Added unique lookup indexes for the device authorization <code>deviceCode</code> and <code>userCode</code> columns (<a href="https://redirect.github.com/better-auth/better-auth/pull/10059">#10059</a>) <blockquote> <p><strong>Migration:</strong> Resolve duplicate code values before applying the migration. MySQL and SQL Server installations must also convert both columns to bounded strings and clean up values longer than 191 characters.</p> </blockquote> </li> <li>Enforced S256 PKCE in the Electron sign-in flow and hardened custom-scheme origin checks (<a href="https://redirect.github.com/better-auth/better-auth/pull/9645">#9645</a>) <blockquote> <p><strong>Migration:</strong> Upgrade the <code>@better-auth/electron</code> client and server together and add your app's scheme to <code>trustedOrigins</code>. The <code>code_challenge_method</code> parameter and <code>disableOriginOverride</code> option are removed, and host-bearing custom-scheme entries now match that host exactly.</p> </blockquote> </li> <li>Identified Microsoft Entra accounts by the stable <code>oid</code> claim (<a href="https://redirect.github.com/better-auth/better-auth/pull/10204">#10204</a>) <blockquote> <p><strong>Migration:</strong> Migrate existing Microsoft account rows created from <code>sub</code> before upgrading. Tokens without a valid <code>oid</code> are rejected.</p> </blockquote> </li> <li>Required a Google client ID before Google One Tap verifies ID tokens (<a href="https://redirect.github.com/better-auth/better-auth/pull/10036">#10036</a>) <blockquote> <p><strong>Migration:</strong> Configure <code>oneTap({ clientId })</code> or <code>socialProviders.google.clientId</code>.</p> </blockquote> </li> <li>Removed the deprecated <code>oidcProvider</code> plugin (<a href="https://redirect.github.com/better-auth/better-auth/pull/10031">#10031</a>) <blockquote> <p><strong>Migration:</strong> Move OIDC authorization-server integrations to <code>@better-auth/oauth-provider</code>.</p> </blockquote> </li> <li>Rewrote the generic OAuth plugin as a first-class social provider with OAuth 2.1 defaults (<a href="https://redirect.github.com/better-auth/better-auth/pull/9069">#9069</a>) <blockquote> <p><strong>Migration:</strong> Replace <code>signIn.oauth2({ providerId })</code> with <code>signIn.social({ provider })</code>, <code>oauth2.link()</code> with <code>linkSocial()</code>, and drop <code>genericOAuthClient()</code>. Callbacks move to <code>/api/auth/callback/:id</code>, <code>pkce</code> now defaults to <code>true</code>, and <code>issuer</code> and <code>requireIssuerValidation</code> are removed in favor of OIDC discovery.</p> </blockquote> </li> <li>Separated OAuth device grant ownership into <code>oauthDeviceAuthorization()</code> (<a href="https://redirect.github.com/better-auth/better-auth/pull/10746">#10746</a>) <blockquote> <p><strong>Migration:</strong> The OAuth integration replaces the optional <code>resource</code> column with <code>oauthClientId</code> and <code>resources</code>, so regenerate and apply the schema. Let pending device codes expire before upgrading from an earlier 1.7 prerelease.</p> </blockquote> </li> <li>Verified provider <code>id_tokens</code> with a single shared verifier (<a href="https://redirect.github.com/better-auth/better-auth/pull/9828">#9828</a>) <blockquote> <p><strong>Migration:</strong> Custom <code>UpstreamProvider</code> implementations replace the removed <code>verifyIdToken</code> method with an <code>idToken</code> config carrying a JWKS source, issuer, and audience. PayPal client <code>id_token</code> sign-in now returns <code>ID_TOKEN_NOT_SUPPORTED</code>; its redirect flow is unchanged.</p> </blockquote> </li> </ul> <h3>Features</h3> <ul> <li>Added <code>clientAssertion</code> support to the Microsoft Entra ID social provider (<a href="https://redirect.github.com/better-auth/better-auth/pull/9898">#9898</a>)</li> <li>Made the <code>Auth</code> instance directly fetchable (<a href="https://redirect.github.com/better-auth/better-auth/pull/9431">#9431</a>)</li> <li>Added per-provider <code>requireEmailVerification</code> for social sign-in (<a href="https://redirect.github.com/better-auth/better-auth/pull/9929">#9929</a>)</li> <li>Added a <code>user.validateUserInfo</code> gate for rejecting an identity before a user is created or linked (<a href="https://redirect.github.com/better-auth/better-auth/pull/9864">#9864</a>)</li> <li>Added <code>hydrateSession</code> so <code>useSession</code> returns server-fetched data on the first render (<a href="https://redirect.github.com/better-auth/better-auth/pull/8733">#8733</a>)</li> <li>Added compound table indexes to plugin database schemas (<a href="https://redirect.github.com/better-auth/better-auth/pull/10402">#10402</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md">better-auth's changelog</a>.</em></p> <blockquote> <h2>1.7.0</h2> <h3>Minor Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/8733">#8733</a> <a href="https://github.com/better-auth/better-auth/commit/4e8e4c7fc5fb2723144cbf41c4a1bfa28de8d671"><code>4e8e4c7</code></a> Thanks <a href="https://github.com/bytaesu"><code>@bytaesu</code></a>! - Add <code>hydrateSession</code> to seed the client with a server-fetched session so <code>useSession</code> returns data on the first render.</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/9930">#9930</a> <a href="https://github.com/better-auth/better-auth/commit/0cbaf81bed9dec4c56880ee78a532262386e1ec5"><code>0cbaf81</code></a> Thanks <a href="https://github.com/gustavovalverde"><code>@gustavovalverde</code></a>! - Anonymous account linking now works after social and generic OAuth sign-in in Expo and other in-app browsers, where the OAuth callback returns without the session cookie. <code>onLinkAccount</code> fires and the anonymous user is migrated; before, it was silently skipped.</p> <p>Plugins can now carry server-trusted data across an OAuth redirect with the new <code>addOAuthServerContext</code> API, read back on the callback via <code>getOAuthState().serverContext</code>. Unlike <code>additionalData</code>, it cannot be set from the request body, so it is the right place for values the server must trust.</p> <p>For <code>@better-auth/oauth-provider</code>, the post-login authorization query now travels through that server-only channel, so it can no longer be injected through <code>additionalData</code>.</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/10004">#10004</a> <a href="https://github.com/better-auth/better-auth/commit/b36c38f9842d3416689340552989449a32007819"><code>b36c38f</code></a> Thanks <a href="https://github.com/bytaesu"><code>@bytaesu</code></a>! - The captcha plugin now requires endpoint entries to match full auth paths unless they use wildcard patterns. This prevents requests like <code>/sign-in//email</code> from bypassing captcha while preserving trailing-slash matches like <code>/sign-in/email/</code>. To protect multiple routes, replace partial paths like <code>/sign-in</code> with explicit wildcards such as <code>/sign-in/*</code> or <code>/sign-in/**</code>.</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/10746">#10746</a> <a href="https://github.com/better-auth/better-auth/commit/6782647d7c2d248246f9ef3980e656725c29ce64"><code>6782647</code></a> Thanks <a href="https://github.com/gustavovalverde"><code>@gustavovalverde</code></a>! - OAuth device grants now use <code>oauthDeviceAuthorization()</code> alongside <code>oauthProvider()</code> or <code>mcp()</code>. This single integration replaces both the standalone <code>deviceCodeGrant()</code> plugin and the shared-grant configuration. Standalone Device Authorization no longer accepts or stores RFC 8707 resources, and <code>onDeviceAuthRequest</code> receives only <code>clientId</code> and <code>scope</code>. The OAuth integration rejects resource indicators that are not absolute, fragment-free URIs.</p> <p>The OAuth integration replaces the optional <code>resource</code> column with <code>oauthClientId</code> and <code>resources</code>. Regenerate and apply the schema when using it. Before upgrading from an earlier 1.7 prerelease, let pending OAuth device codes expire or delete them because they cannot be exchanged through the new integration.</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/10402">#10402</a> <a href="https://github.com/better-auth/better-auth/commit/763a2671c5372d88c291881977c8a1c2e29034b1"><code>763a267</code></a> Thanks <a href="https://github.com/gustavovalverde"><code>@gustavovalverde</code></a>! - Plugin database schemas can now define named or generated table-level indexes across multiple fields. SQL migrations and generated Drizzle or Prisma schemas resolve configured table and column names consistently, while the MongoDB adapter creates the same indexes before the first index-enforcing write.</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/9766">#9766</a> <a href="https://github.com/better-auth/better-auth/commit/bf39cbf13f3b934f728cde72b1e7ebdc4c85f641"><code>bf39cbf</code></a> Thanks <a href="https://github.com/GautamBytes"><code>@GautamBytes</code></a>! - Add a server-only <code>auth.api.consumePhoneNumberOTP</code> API for custom phone OTP flows that need to verify and consume a code without creating or updating users or sessions.</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/10330">#10330</a> <a href="https://github.com/better-auth/better-auth/commit/081d3c379c720926295067d878c421b5e8684c78"><code>081d3c3</code></a> Thanks <a href="https://github.com/ping-maxwell"><code>@ping-maxwell</code></a>! - Allow the username plugin's separate <code>displayUsername</code> field to be omitted by setting <code>displayUsername: false</code> on both the server and client plugins.</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/10059">#10059</a> <a href="https://github.com/better-auth/better-auth/commit/49b5cf650e1264ecc4c917ca193ea05c3b58a3b9"><code>49b5cf6</code></a> Thanks <a href="https://github.com/GautamBytes"><code>@GautamBytes</code></a>! - Device Authorization now creates unique database indexes for <code>deviceCode</code> and <code>userCode</code>, so each generated code must be unique in its column. Existing installations on every adapter must resolve duplicate values before applying the migration. MySQL and SQL Server installations must also convert both columns to bounded strings and clean up values longer than 191 characters before running it.</p> <p>Generated codes are limited to 191 characters. Issuance makes up to 3 attempts to overcome unique-key collisions, then returns <code>server_error</code> if it cannot create a unique <code>deviceCode</code> and <code>userCode</code>. Default-generated user codes accept case changes and readability separators during verification, approval, and denial; custom codes outside the default alphabet are matched exactly. The <code>/device</code> limiter allows 5 requests over a window equal to the configured code lifetime, while <code>/device/token</code> polling keeps its separate interval behavior.</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/9645">#9645</a> <a href="https://github.com/better-auth/better-auth/commit/e0140297a59ddb59cccbcb4ba46c513de8cb86a7"><code>e014029</code></a> Thanks <a href="https://github.com/ping-maxwell"><code>@ping-maxwell</code></a>! - Harden the Electron OAuth flow and tighten custom-scheme trusted-origin matching.</p> <p>The Electron sign-in flow now mandates PKCE S256. Plain PKCE is rejected: the <code>code_challenge_method</code> parameter is gone and every authorization code is verified by hashing the verifier with SHA-256. The server no longer trusts an <code>electron-origin</code> header to set the request Origin. The Electron client now sends a real <code>Origin</code> (for example <code>myapp:/</code>), so upgrade the <code>@better-auth/electron</code> client and server together and make sure your app's scheme is in <code>trustedOrigins</code>. The unused <code>disableOriginOverride</code> option is removed.</p> <p>Custom-scheme entries in <code>trustedOrigins</code> now match by scheme and authority instead of string prefix. A host-less entry such as <code>myapp://</code> or <code>exp://</code> still trusts every host of that scheme, but a host-bearing entry such as <code>myapp://callback</code> matches that host exactly, so it is no longer satisfied by <code>myapp://callback.attacker.tld</code>.</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/9948">#9948</a> <a href="https://github.com/better-auth/better-auth/commit/3d04fababbf3efd4c46a4012f46ed9397715c2e3"><code>3d04fab</code></a> Thanks <a href="https://github.com/yordis"><code>@yordis</code></a>! - feat(generic-oauth): add <code>refreshTokenParams</code> config to forward extra params on token refresh</p> <p>Multi-tenant OIDC providers (Zitadel multi-org, Auth0 with <code>audience</code>) need to send extra body params on the refresh call to rescope tokens without a full authorization redirect. The generic-oauth plugin now accepts a <code>refreshTokenParams</code> option (object or sync/async function) that is merged into the refresh request body, with <code>grant_type</code> and <code>refresh_token</code> protected from override. The function form receives request metadata for the request that triggered the refresh, so request-scoped data (headers, cookies) is available without out-of-band state like AsyncLocalStorage.</p> <p><code>UpstreamProvider.refreshAccessToken</code> now accepts an optional second <code>ctx</code> argument; the change is backwards compatible because existing implementations that take only <code>refreshToken</code> remain valid. See <a href="https://redirect.github.com/better-auth/better-auth/issues/7554">#7554</a>.</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/9069">#9069</a> <a href="https://github.com/better-auth/better-auth/commit/c7d22539ec4f7322d9625ae2953d397c3863d097"><code>c7d2253</code></a> Thanks <a href="https://github.com/gustavovalverde"><code>@gustavovalverde</code></a>! - Rewrite the generic OAuth plugin as a first-class social provider with OAuth 2.1 security defaults. Providers now use <code>signIn.social</code> + <code>callback/:id</code> instead of dedicated plugin endpoints, with PKCE required by default (OAuth 2.1), RFC 9207 issuer validation, OIDC auto-discovery with <code>openid</code> scope injection, and typed provider IDs.</p> <p><strong>Breaking changes:</strong></p> <ul> <li><code>signIn.oauth2({ providerId })</code> replaced by <code>signIn.social({ provider })</code></li> <li><code>oauth2.link()</code> replaced by <code>linkSocial()</code></li> <li>Callback URL changed from <code>/api/auth/oauth2/callback/:id</code> to <code>/api/auth/callback/:id</code></li> <li><code>genericOAuthClient()</code> removed; generic OAuth providers now use the standard social client APIs</li> <li><code>pkce</code> defaults to <code>true</code> (was <code>false</code>); set <code>pkce: false</code> for providers that reject PKCE</li> <li><code>authorizationUrlParams</code> and <code>tokenUrlParams</code> only accept <code>Record<string, string></code></li> </ul> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/better-auth/better-auth/commit/ccd57c2dcb145a40a30c75ab3f6c89b94af08701"><code>ccd57c2</code></a> docs(changelog): align v1.7 release notes with final behavior (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10846">#10846</a>)</li> <li><a href="https://github.com/better-auth/better-auth/commit/f577ec5c766c4ccd0a677ad18ca5f4f17b245289"><code>f577ec5</code></a> chore: exit pre-release mode for v1.7.0</li> <li><a href="https://github.com/better-auth/better-auth/commit/69258d16709b977e519aa00a323ae54aea2b6164"><code>69258d1</code></a> chore: sync main to next</li> <li><a href="https://github.com/better-auth/better-auth/commit/e84ec5e76d30e10fd692e8084177360484d538c1"><code>e84ec5e</code></a> chore: release v1.6.30 (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10840">#10840</a>)</li> <li><a href="https://github.com/better-auth/better-auth/commit/bc93b27542cbdf74f6455e6f66a0b4292c247a12"><code>bc93b27</code></a> chore: release v1.7.0-rc.6 (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10772">#10772</a>)</li> <li><a href="https://github.com/better-auth/better-auth/commit/58c49eb97f04ff18aa823318a3856a013353fdc2"><code>58c49eb</code></a> chore: release v1.6.29 (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10809">#10809</a>)</li> <li><a href="https://github.com/better-auth/better-auth/commit/e6e1b4e8146a84d2a2c5fe2c497c81d03dfc2ad3"><code>e6e1b4e</code></a> perf(db): replace sequential get-then-delete loop with parallel deletes in de...</li> <li><a href="https://github.com/better-auth/better-auth/commit/80799e69314d4d13c875457d932545d54fbc7ada"><code>80799e6</code></a> chore: sync main to next</li> <li><a href="https://github.com/better-auth/better-auth/commit/3e485bf730c62b4ef3df2e55198179c3d15b5a9f"><code>3e485bf</code></a> docs(username): fix displayUsername release notes (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10776">#10776</a>)</li> <li><a href="https://github.com/better-auth/better-auth/commit/65fc17c755c3e2c8c77d5b401d612737764c219d"><code>65fc17c</code></a> fix(deps): align <code>drizzle-orm</code> peer range with drizzle-adapter (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10501">#10501</a>)</li> <li>Additional commits viewable in <a href="https://github.com/better-auth/better-auth/commits/v1.7.0/packages/better-auth">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
|
c5382b36ba |
build(deps-dev): bump vite from 6.4.3 to 8.2.2 (#11887)
Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) from 6.4.3 to 8.2.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vitejs/vite/releases">vite's releases</a>.</em></p> <blockquote> <h2>plugin-legacy@8.2.2</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/plugin-legacy@8.2.2/packages/plugin-legacy/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v8.2.2</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v8.2.2/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>plugin-legacy@8.2.1</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/plugin-legacy@8.2.1/packages/plugin-legacy/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v8.2.1</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v8.2.1/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>create-vite@8.2.0</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/create-vite@8.2.0/packages/create-vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>plugin-legacy@8.2.0</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/plugin-legacy@8.2.0/packages/plugin-legacy/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v8.2.0</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v8.2.0/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v8.2.0-beta.0</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v8.2.0-beta.0/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v8.1.5</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v8.1.5/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v8.1.4</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v8.1.4/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v8.1.3</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v8.1.3/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v8.1.2</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v8.1.2/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v8.1.1</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v8.1.1/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>create-vite@8.1.0</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/create-vite@8.1.0/packages/create-vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>plugin-legacy@8.1.0</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/plugin-legacy@8.1.0/packages/plugin-legacy/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v8.1.0</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v8.1.0/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>plugin-legacy@8.1.0-beta.0</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/plugin-legacy@8.1.0-beta.0/packages/plugin-legacy/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md">vite's changelog</a>.</em></p> <blockquote> <h2><!-- raw HTML omitted --><a href="https://github.com/vitejs/vite/compare/v8.2.1...v8.2.2">8.2.2</a> (2026-08-20)<!-- raw HTML omitted --></h2> <h3>Features</h3> <ul> <li><strong>deps:</strong> widen <code>@vitejs/devtools</code> peer range to v0.5.0 (<a href="https://redirect.github.com/vitejs/vite/issues/23302">#23302</a>) (<a href="https://github.com/vitejs/vite/commit/495d9ff5a7d843ca876a9e49799947a5deb704c7">495d9ff</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li><strong>bundled-dev:</strong> handle lazy request error (<a href="https://redirect.github.com/vitejs/vite/issues/23291">#23291</a>) (<a href="https://github.com/vitejs/vite/commit/3ba026dade4af56df08815310d3458fa110f5c5c">3ba026d</a>)</li> <li><strong>bundled-dev:</strong> hot update through circular imports instead of reloading (<a href="https://redirect.github.com/vitejs/vite/issues/23259">#23259</a>) (<a href="https://github.com/vitejs/vite/commit/3dbddefaafc091a879b06f9279296f776691e455">3dbddef</a>)</li> <li><strong>config:</strong> resolve sourcemap paths against sourcemap location (<a href="https://redirect.github.com/vitejs/vite/issues/23239">#23239</a>) (<a href="https://github.com/vitejs/vite/commit/05a003e6a17a84d75f907ea0f1598bc39b8dce6c">05a003e</a>)</li> <li><strong>css:</strong> don't pass empty targets to lightningcss (<a href="https://redirect.github.com/vitejs/vite/issues/23295">#23295</a>) (<a href="https://github.com/vitejs/vite/commit/2804636ff608d105928009d274ffba7cfbe55340">2804636</a>)</li> <li><strong>define:</strong> fix match escaped dots to support $-prefixed define keys (<a href="https://redirect.github.com/vitejs/vite/issues/23249">#23249</a>) (<a href="https://github.com/vitejs/vite/commit/dcf88bd2ad2b1a8845f9029587cc8c825e382d42">dcf88bd</a>)</li> <li><strong>deps:</strong> update all non-major dependencies (<a href="https://redirect.github.com/vitejs/vite/issues/23217">#23217</a>) (<a href="https://github.com/vitejs/vite/commit/ba958bddfc9cabe302c6b34269dcf5c9634531e0">ba958bd</a>)</li> <li><strong>deps:</strong> update rolldown-related dependencies (<a href="https://redirect.github.com/vitejs/vite/issues/23218">#23218</a>) (<a href="https://github.com/vitejs/vite/commit/83ecb2c8059e8ce946a7cc835d4c14ef78aef4fd">83ecb2c</a>)</li> <li><strong>module-runner:</strong> exclude completed modules from in-flight cycle detection (fix <a href="https://redirect.github.com/vitejs/vite/issues/22999">#22999</a>) (<a href="https://redirect.github.com/vitejs/vite/issues/23009">#23009</a>) (<a href="https://github.com/vitejs/vite/commit/d9b10a98db1c293ee64300bd75d568b44c8ae931">d9b10a9</a>)</li> <li><strong>optimizer:</strong> close custom extension analysis bundles (<a href="https://redirect.github.com/vitejs/vite/issues/23207">#23207</a>) (<a href="https://github.com/vitejs/vite/commit/8fb76752836f61224d3095b502fa237b478a06b2">8fb7675</a>)</li> <li>reduce Windows 8.3-short-name detection false-positives (<a href="https://redirect.github.com/vitejs/vite/issues/23066">#23066</a>) (<a href="https://github.com/vitejs/vite/commit/02cffa9e2d38d5d8f12e4043ee9d0f7abb1471e2">02cffa9</a>)</li> <li>respect <code>resolve.preserveSymlinks</code> when resolving root (fix <a href="https://redirect.github.com/vitejs/vite/issues/23197">#23197</a>) (<a href="https://redirect.github.com/vitejs/vite/issues/23198">#23198</a>) (<a href="https://github.com/vitejs/vite/commit/8413052731836d4aaf3eb94a0f25788dd35d2888">8413052</a>)</li> <li><strong>ssr:</strong> rewrite computed key of destructing parameter (<a href="https://redirect.github.com/vitejs/vite/issues/23307">#23307</a>) (<a href="https://github.com/vitejs/vite/commit/9db0b61d4c9c7caad7ea1d9670b637faf2bb6c93">9db0b61</a>)</li> <li><strong>vite:</strong> update outdated upstream file links in license comments (<a href="https://redirect.github.com/vitejs/vite/issues/23285">#23285</a>) (<a href="https://github.com/vitejs/vite/commit/c0f2fc607ee97ee4499337b04826420c00654065">c0f2fc6</a>)</li> </ul> <h3>Documentation</h3> <ul> <li><strong>build:</strong> note cssTarget precedence (<a href="https://redirect.github.com/vitejs/vite/issues/23200">#23200</a>) (<a href="https://github.com/vitejs/vite/commit/a20a35ec0685e374519864d0f41dd5f6e9ba0271">a20a35e</a>)</li> </ul> <h3>Miscellaneous Chores</h3> <ul> <li>fix ts errors in build test cases (<a href="https://redirect.github.com/vitejs/vite/issues/23209">#23209</a>) (<a href="https://github.com/vitejs/vite/commit/a0cfcf72f8ef8bf0f2f11d553333b9bb31f1d316">a0cfcf7</a>)</li> </ul> <h3>Code Refactoring</h3> <ul> <li>use JSON import attributes instead of readFileSync in constants (<a href="https://redirect.github.com/vitejs/vite/issues/23258">#23258</a>) (<a href="https://github.com/vitejs/vite/commit/1d9fa392a43229241f80630236f8552ce8f7cd0f">1d9fa39</a>)</li> <li>use named regex constants over inline literals (<a href="https://redirect.github.com/vitejs/vite/issues/22964">#22964</a>) (<a href="https://github.com/vitejs/vite/commit/5c1c6c609718303202832f706884192e1f1e9223">5c1c6c6</a>)</li> </ul> <h3>Tests</h3> <ul> <li><strong>define:</strong> close rolldown bundler after generate (<a href="https://redirect.github.com/vitejs/vite/issues/23231">#23231</a>) (<a href="https://github.com/vitejs/vite/commit/b4d66fee14d970f45b8a6f3d7d6aee73ca9b88ab">b4d66fe</a>)</li> <li><strong>module-runner:</strong> add TLA circular import case (<a href="https://redirect.github.com/vitejs/vite/issues/23299">#23299</a>) (<a href="https://github.com/vitejs/vite/commit/4a261f242831bef92afd2f1aacfb81eab9dec371">4a261f2</a>)</li> <li><strong>module-runner:</strong> simplify server-hmr tests (<a href="https://redirect.github.com/vitejs/vite/issues/23300">#23300</a>) (<a href="https://github.com/vitejs/vite/commit/599b44b6600ec426e10cd556908d53b027b0c4fb">599b44b</a>)</li> <li><strong>ssr:</strong> add destructing assignment case for moduleRunnerTransform (<a href="https://redirect.github.com/vitejs/vite/issues/23308">#23308</a>) (<a href="https://github.com/vitejs/vite/commit/cb77e2a93bad2a8ece00b4aa0ef507c092582c45">cb77e2a</a>)</li> </ul> <h3>Build System</h3> <ul> <li>use JSON import attributes instead of readFIleSync in rolldown configs (<a href="https://redirect.github.com/vitejs/vite/issues/23251">#23251</a>) (<a href="https://github.com/vitejs/vite/commit/d615bcdb23d96c1ca5ce1ee45e21d8d87381106f">d615bcd</a>)</li> </ul> <h2><!-- raw HTML omitted --><a href="https://github.com/vitejs/vite/compare/v8.2.0...v8.2.1">8.2.1</a> (2026-08-06)<!-- raw HTML omitted --></h2> <h3>Bug Fixes</h3> <ul> <li><strong>build:</strong> make client chunkImportMap work with <code>sharedPlugins: true</code> (<a href="https://redirect.github.com/vitejs/vite/issues/23184">#23184</a>) (<a href="https://github.com/vitejs/vite/commit/15f03073c915d6ffb9a1fda447ef66b02bf5cde8">15f0307</a>)</li> <li><strong>bundled-dev:</strong> inject client script tag before chunk scripts (<a href="https://redirect.github.com/vitejs/vite/issues/23161">#23161</a>) (<a href="https://github.com/vitejs/vite/commit/eac0cc84aa2472a85a19ee84561c1ba71e381a55">eac0cc8</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vitejs/vite/commit/de1111ab0be00879b404e7ed3b2a80e264edddc1"><code>de1111a</code></a> release: v8.2.2</li> <li><a href="https://github.com/vitejs/vite/commit/cb77e2a93bad2a8ece00b4aa0ef507c092582c45"><code>cb77e2a</code></a> test(ssr): add destructing assignment case for moduleRunnerTransform (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23308">#23308</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/9db0b61d4c9c7caad7ea1d9670b637faf2bb6c93"><code>9db0b61</code></a> fix(ssr): rewrite computed key of destructing parameter (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23307">#23307</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/8413052731836d4aaf3eb94a0f25788dd35d2888"><code>8413052</code></a> fix: respect <code>resolve.preserveSymlinks</code> when resolving root (fix <a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23197">#23197</a>) (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23">#23</a>...</li> <li><a href="https://github.com/vitejs/vite/commit/05a003e6a17a84d75f907ea0f1598bc39b8dce6c"><code>05a003e</code></a> fix(config): resolve sourcemap paths against sourcemap location (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23239">#23239</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/495d9ff5a7d843ca876a9e49799947a5deb704c7"><code>495d9ff</code></a> feat(deps): widen <code>@vitejs/devtools</code> peer range to v0.5.0 (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23302">#23302</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/1d9fa392a43229241f80630236f8552ce8f7cd0f"><code>1d9fa39</code></a> refactor: use JSON import attributes instead of readFileSync in constants (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/2">#2</a>...</li> <li><a href="https://github.com/vitejs/vite/commit/2804636ff608d105928009d274ffba7cfbe55340"><code>2804636</code></a> fix(css): don't pass empty targets to lightningcss (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23295">#23295</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/599b44b6600ec426e10cd556908d53b027b0c4fb"><code>599b44b</code></a> test(module-runner): simplify server-hmr tests (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23300">#23300</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/4a261f242831bef92afd2f1aacfb81eab9dec371"><code>4a261f2</code></a> test(module-runner): add TLA circular import case (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23299">#23299</a>)</li> <li>Additional commits viewable in <a href="https://github.com/vitejs/vite/commits/v8.2.2/packages/vite">compare view</a></li> </ul> </details> <br /> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Priya Raman <priya@paperclip.ing> Co-authored-by: Paperclip <noreply@paperclip.ing> |
||
|
dependabot[bot]
|
3a841e15d0 |
build(deps-dev): bump @types/supertest from 6.0.3 to 7.2.1 (#11878)
Bumps [@types/supertest](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/supertest) from 6.0.3 to 7.2.1. <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/supertest">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
ab4c4941f2 |
build(deps): bump @aws-sdk/client-s3 from 3.1111.0 to 3.1115.0 (#11876)
Bumps [@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3) from 3.1111.0 to 3.1115.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/aws/aws-sdk-js-v3/releases">@aws-sdk/client-s3's releases</a>.</em></p> <blockquote> <h2>v3.1115.0</h2> <h4>3.1115.0(2026-08-20)</h4> <h5>Documentation Changes</h5> <ul> <li><strong>client-pricing-plan-manager:</strong> Documentation update for the CreateSubscription API to correct the default value of the approval mode parameter. The default value for paid subscriptions is MANUAL, not IMMEDIATE as previously documented. The default value remains IMMEDIATE for FREE tier subscriptions. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/50d16ae3f271fe02a775de35ff81f96c3fc3f3f5">50d16ae3</a>)</li> </ul> <h5>New Features</h5> <ul> <li><strong>client-sesv2:</strong> Amazon SES now supports per-message tracking overrides. You can use the new ConfigurationOverrides parameter in SendEmail and SendBulkEmail to enable or disable open and click tracking for individual messages without changing your account-level or configuration set settings. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/da56caa551406c67f4add96bcb7a98ac9ad9ec5d">da56caa5</a>)</li> <li><strong>client-arc-region-switch:</strong> Adds support for Rds switchover read replica for Oracle databases in Region switch plans (<a href="https://github.com/aws/aws-sdk-js-v3/commit/85ffb20a7857736b13916df32017903c6fd0b3e0">85ffb20a</a>)</li> <li><strong>client-ec2:</strong> EC2 marks UEFI instance metadata field as sensitive. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/c232746ad78da7961a997005c6102943c392c30c">c232746a</a>)</li> <li><strong>client-direct-connect:</strong> This release adds custom route prefix pool allocations for Direct Connect. You can set IPv4 and IPv6 route prefix counts on private and transit virtual interfaces, and view pool size and unallocated counts on connections and LAGs, plus direct connect gateway attachment prefix allocation totals. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/a94fb9783b97be5c59ef543ea7448d0e09f6f048">a94fb978</a>)</li> <li><strong>client-amplify:</strong> Increased the maximum allowed length from 255 to 4,096 characters to support longer access tokens. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/f7f8ecd1b8b45ba69bb48d1ac61a5bafc2a2d672">f7f8ecd1</a>)</li> <li><strong>client-batch:</strong> AWS Batch now supports a new compute environment type that provides fully managed EC2 capacity with broader compute flexibility than Fargate, including GPU instances, bare metal, and specific instance type selection, without infrastructure management overhead. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/9c559a7366166cbe4e81c2752eb1c26696a884a9">9c559a73</a>)</li> <li><strong>client-sagemaker:</strong> Added IAM Identity Center (IdC) support to CreatePartnerApp and UpdatePartnerApp APIs. Added Customer Managed Key (CMK) support to CreateMlflowApp and DescribeMlflowApp. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/5548588739d30ba5b7ebf1c6a88fa5749adb15b0">55485887</a>)</li> <li><strong>client-lambda:</strong> Adds support for full JSON resource-based policies, enabling customers to create, retrieve, update, and delete function resource policies as complete JSON documents. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/72573a2ad860a406a0fe742dfd40b50458b6153d">72573a2a</a>)</li> <li><strong>client-cloudfront:</strong> Added SigV4a as a supported signing protocol for Origin Access Control (OAC), enabling CloudFront to sign requests to Amazon S3 Multi-Region Access Point (S3-MRAP) origins. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/95476293d5fa70f266cb4aa4c54ecebce9c771ce">95476293</a>)</li> </ul> <hr /> <p>For list of updated packages, view <strong>updated-packages.md</strong> in <strong>assets-3.1115.0.zip</strong></p> <h2>v3.1114.0</h2> <h4>3.1114.0(2026-08-19)</h4> <h5>New Features</h5> <ul> <li><strong>client-eks:</strong> Adds support for EKS cluster certificate authorities (CA) (<a href="https://github.com/aws/aws-sdk-js-v3/commit/a1316eaec0734d880bdb975c082110f36d3d7180">a1316eae</a>)</li> <li><strong>client-bedrock-agentcore-control:</strong> AgentCore Memory now supports Flexible Namespaces (<a href="https://github.com/aws/aws-sdk-js-v3/commit/65c89d6d82897e07d0d671fbd0a3a0a44a93a9a2">65c89d6d</a>)</li> <li><strong>client-batch:</strong> AWS Batch now supports managing CloudWatch Container Insights on compute environments via CreateComputeEnvironment and UpdateComputeEnvironment. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/f77fc37f101238d66a1849924da42be3ac50f4c5">f77fc37f</a>)</li> <li><strong>client-redshift:</strong> Amazon Redshift enhanced System Table retention that allows customers to store their system table data directly in S3 Tables in customer's account instead of Redshift Managed Storage (<a href="https://github.com/aws/aws-sdk-js-v3/commit/a46d1f96345459f8c606642be702b8a723d97d51">a46d1f96</a>)</li> <li><strong>client-bedrock-agentcore:</strong> AgentCore Memory now supports Flexible Namespaces and Non-Conversational Payloads in CreateEvent API (<a href="https://github.com/aws/aws-sdk-js-v3/commit/a0d8fb6df9d13bd1f22f89c1a5defef183becaf4">a0d8fb6d</a>)</li> <li><strong>client-medialive:</strong> AWS Elemental MediaLive now supports video cropping and output positioning. Use cropRectangle and outputPositionRectangle to position the encoded video within the output frame, with the surrounding area filled with black. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/2bf1331a81cddad987b30380c685cc3b4f85f18b">2bf1331a</a>)</li> <li><strong>client-account-access:</strong> Adds throttling exceptions to operation outputs that were previously inconsistent with other operations. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/1e39b38544c7b77246db936bc6313163f98718b9">1e39b385</a>)</li> <li><strong>client-vpc-lattice:</strong> Amazon VPC Lattice now supports modification of private DNS options on Service Network VPC Associations (<a href="https://github.com/aws/aws-sdk-js-v3/commit/92c89b2723c281f6fc8d2562ec86dbd3c9716bdf">92c89b27</a>)</li> <li><strong>client-redshift-serverless:</strong> Amazon Redshift Enhanced System Table Retention that allows customers to store their system table data directly in S3 Tables in customer's account instead of Redshift Managed Storage (<a href="https://github.com/aws/aws-sdk-js-v3/commit/73ad53c311578c41c4420d71835f63ff021b703a">73ad53c3</a>)</li> <li><strong>lib-transfer-manager:</strong> add file based download api and worker thread based download. (<a href="https://redirect.github.com/aws/aws-sdk-js-v3/pull/8259">#8259</a>) (<a href="https://github.com/aws/aws-sdk-js-v3/commit/b2d60357c87e86ce7da8902c9bd243bcc3bb34b2">b2d60357</a>)</li> </ul> <hr /> <p>For list of updated packages, view <strong>updated-packages.md</strong> in <strong>assets-3.1114.0.zip</strong></p> <h2>v3.1113.0</h2> <h4>3.1113.0(2026-08-18)</h4> <h5>Chores</h5> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md">@aws-sdk/client-s3's changelog</a>.</em></p> <blockquote> <h1><a href="https://github.com/aws/aws-sdk-js-v3/compare/v3.1114.0...v3.1115.0">3.1115.0</a> (2026-08-20)</h1> <p><strong>Note:</strong> Version bump only for package <code>@aws-sdk/client-s3</code></p> <h1><a href="https://github.com/aws/aws-sdk-js-v3/compare/v3.1113.0...v3.1114.0">3.1114.0</a> (2026-08-19)</h1> <p><strong>Note:</strong> Version bump only for package <code>@aws-sdk/client-s3</code></p> <h1><a href="https://github.com/aws/aws-sdk-js-v3/compare/v3.1112.0...v3.1113.0">3.1113.0</a> (2026-08-18)</h1> <p><strong>Note:</strong> Version bump only for package <code>@aws-sdk/client-s3</code></p> <h1><a href="https://github.com/aws/aws-sdk-js-v3/compare/v3.1111.0...v3.1112.0">3.1112.0</a> (2026-08-17)</h1> <p><strong>Note:</strong> Version bump only for package <code>@aws-sdk/client-s3</code></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/aws/aws-sdk-js-v3/commit/efc86fc9c3f80861228ad7f1b2fc97084b7a1c20"><code>efc86fc</code></a> Publish v3.1115.0</li> <li><a href="https://github.com/aws/aws-sdk-js-v3/commit/5318b44c47c47e50ee77d6d8044cf8a472d2d08f"><code>5318b44</code></a> Publish v3.1114.0</li> <li><a href="https://github.com/aws/aws-sdk-js-v3/commit/73a06d2aeb7261977dbffd4f604a6dafc3c2d381"><code>73a06d2</code></a> Publish v3.1113.0</li> <li><a href="https://github.com/aws/aws-sdk-js-v3/commit/cb4ae7624bd56b21e127496f9641912b1a5a8ce2"><code>cb4ae76</code></a> Publish v3.1112.0</li> <li>See full diff in <a href="https://github.com/aws/aws-sdk-js-v3/commits/v3.1115.0/clients/client-s3">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
DottaandPaperclip
|
ffff1fe6e3 |
feat(runner): define package API and verification boundary (#12129)
## Thinking Path > - Paperclip is the open source app people use to manage AI agents for work. > - The runner package now has protocol, transport, provider, catalog, and authorization foundations. > - Its first upstream package boundary should expose only the implemented runtime and test-helper surfaces. > - Rust correctness belongs in the repository existing build verification, without introducing a parallel release process. > - Direct package creation must build the files declared by the package manifest. > - This pull request defines the minimal package API and verifies the optimized runner binaries in the existing PR and release Build jobs. > - The benefit is a production-ready runner package boundary with minimal build-process change. ## Linked Issues or Issue Description Refs #11962 This pull request replaces one bounded part of the archived large runner change. It follows the package-local authorization change in #12126. ## What Changed - Export only `@paperclipai/paperclip-runner` and `@paperclipai/paperclip-runner/testing`. - Keep Node-only fixture loading and semantic conformance helpers out of the runtime root. - Add a provider-neutral semantic conformance kit with stable JSON comparison and fail-closed input checks. - Keep deferred SDK, eval, browser, React, lab, and command surfaces private. - Pin the runner Rust toolchain to 1.97.1 with the minimal profile and `rustfmt`. - Run the Rust workspace tests in release mode. - Launch the optimized `paperclip-runnerd` and fake-harness binaries in process-level integration coverage. - Add one `pnpm --filter @paperclipai/paperclip-runner check:all` step to each existing PR and release Build job. - Make the existing server `prepack` lifecycle run its existing build after it prepares UI assets. - Document that no production adapter starts runnerd yet. This revision adds no standalone GitHub Actions job. It adds no server runner dependency or runner vendoring. It adds no Docker bootstrap or clean-consumer harness. It does not change `pnpm-lock.yaml`. ## Verification - `pnpm --filter @paperclipai/paperclip-runner check:all` - 66 TypeScript tests - 8 protocol contract tests - 56 Rust unit and integration tests - Release-mode integration coverage launches the optimized runnerd and fake-harness binaries. - `pnpm --filter @paperclipai/server exec vitest run src/__tests__/server-package-build-script.test.ts` (2 tests) - Clean `pnpm pack` from `server/` rebuilt the server and produced both `package/dist/index.js` and `package/dist/index.d.ts`. - `node --test scripts/__tests__/release-verify-workflow.test.mjs` (8 tests) - `pnpm -r typecheck` - `pnpm build` - `pnpm check:token-gates` - `git diff --check` - No `pnpm-lock.yaml` diff. - The diff changes 12 files. ## Risks The runner adds Rust work to the existing Build jobs. These jobs can take longer on a cold cache. The pinned toolchain makes contributor and CI behavior reproducible. Cargo tests use `--release` to verify optimized executables. The server prepack lifecycle now performs the build that its published entry points require. This can make direct server packing slower. This pull request does not wire runnerd into the server. It does not select runnerd for any adapter. Existing application execution and finalization paths remain unchanged. ## Model Used OpenAI Codex with GPT-5. Agentic coding mode used repository tools, code execution, and automated tests. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge Co-authored-by: Paperclip <noreply@paperclip.ing> |
||
|
Nicky LeachandPaperclip
|
63df7ad2b3 |
feat(login): use the login pseudo-terminal for Codex device login and de-Claude the shared channel (#12020)
## Thinking Path > - Paperclip is the open source app people use to manage AI agents for work > - Agent adapters use provider-specific login flows > - Codex device login needs a live pseudo-terminal (PTY), while the shared channel still uses Claude-specific names > - The old streamed-exec path does not provide the prompt transport that Codex needs > - This pull request moves Codex device login to the shared login PTY and removes the dead streamed-exec path > - The benefit is one controlled login transport with fail-closed capability checks and safer credential reads ## Linked Issues or Issue Description **Problem or motivation** Codex device login used a streamed-exec path that did not provide the required prompt transport. The shared login channel also exposed Claude-specific names outside Claude code. **Expected behavior** The host selects a fixed login command from trusted adapter data. Codex login uses the provider login PTY. Providers without that capability fail closed. **Proposed solution** Use a server-controlled session home, create and validate it as a fresh 0700 directory, read credentials from one validated descriptor, and rename shared channel names to the neutral login PTY family. **Alternatives considered** Keep the shared login PTY as the single transport. Do not keep the removed streamed-exec path because it cannot provide the required prompt transport. **Roadmap alignment** This change supports the planned login transport work. It does not add a separate roadmap item. ## What Changed - Route Codex device login through the shared login PTY transport. - Select the login command from a closed internal command key. - Carry a server-controlled session home through the launch contract. - Create and validate the session home as a fresh 0700 directory owned by the login user. - Read the credential file with descriptor-relative, no-follow path walking and final descriptor checks. - Gate the login route and run lease on the provider login PTY capability. - Rename shared channel names to the neutral login PTY family. - Remove the streamed-exec transport value, selector field, driver branch, and related tests. - Hide Codex login in the user interface when the provider lacks the login PTY capability. ## Verification - Server unit suites pass: 89/89. - Adapter-utils suites pass: 262/262. - Codex-local suites pass: 326/326. - Credential-read reader suite passes: 20/20. - Daytona login PTY suite passes: 30/30. - Device-login suites pass: 56/56. - TypeScript checks pass for server, adapter-utils, and UI. - GitHub Actions must pass after pull request creation. - Greptile review must reach 5/5 with no open P2 findings, recommendations, or follow-ups. ## Risks - Providers without a login PTY capability lose Codex login support by design. - The credential read rejects invalid ownership, mode, type, path, and size. - The launch-time sandbox directory race remains outside the threat model because the login runs inside the sandbox and a hostile sandbox already controls its credential. ## Model Used OpenAI Codex, GPT-5, tool use and code review assistance. The exact context window and reasoning mode are not exposed by the runtime. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Paperclip <noreply@paperclip.ing> |
||
|
Nicky LeachandPaperclip
|
38d8f37172 |
fix(build): enforce Node 24 across Paperclip (#11792)
## Thinking Path > - Paperclip is the open source app people use to manage AI agents for work. > - Paperclip runs across the CLI, server, adapters, plugins, CI, and container images. > - These surfaces declared different Node.js versions from 20 through 24. > - A newer `@types/node` major can expose APIs that the supported runtime does not provide. > - Node.js 20 is no longer a suitable project baseline, and Node.js 24 is the current LTS line. > - This pull request sets Node.js 24.11.0 as one repository-wide baseline, adds a drift check, and gives users actionable startup guidance when their runtime is too old. > - The benefit is one clear runtime contract for development, release, installation, and published packages. ## Linked Issues or Issue Description Refs #2734 Refs #11727 Refs #739 ## What Changed - Require Node.js 24.11.0 or newer in all 42 package manifests and runtime checks. - Use Node.js 24 in GitHub Actions, Docker images, smoke images, sandbox setup, portable installs, and esbuild targets. - Align every direct `@types/node` declaration on `^24.0.0`. - Prevent Dependabot from opening major `@types/node` upgrades without a matching runtime decision. - Add `.nvmrc` and a CI policy check for Node version drift. - Update ACP version gates, tests, and user documentation for the new minimum. - Print a non-blocking warning on CLI and server startup when Node is unsupported, with remediation through a version manager or the documented downloaded `install.sh` workflow. - Deduplicate that warning when `paperclipai run` boots the CLI and server in the same process. ## Verification - `node scripts/check-node-version-policy.mjs` - `node --check scripts/check-node-version-policy.mjs` - `node --check cli/esbuild.config.mjs` - `node --check scripts/generate-npm-package-json.mjs` - `bash -n scripts/install.sh scripts/test-install-sh-docker.sh scripts/e2e-install-lifecycle.sh` - Parsed all 42 package manifests and confirmed `engines.node` is `>=24.11.0`. - `git diff --check` - `vitest run packages/adapter-utils/src/sandbox-install-command.test.ts` passed with 3 tests. - `vitest run cli/src/node-version.test.ts` passed with 4 tests. - Directly exercised the shared warning helper for unsupported-version messaging and same-process deduplication. - The focused exe.dev suite could not resolve the locally unbuilt plugin SDK from this isolated worktree. A full offline workspace install was also blocked because the package-manager signature verifier requires registry access. The full suite was not run locally; draft CI performs a clean install and evaluates the wider impact. ## Risks - This is a breaking runtime change for users, plugins, and deployments that still use Node.js 20 or 22. - Published workspace packages will now produce an engine warning or failure in strict package managers on older Node.js releases. - Node.js 24 can reveal dependency, native module, Playwright, or agent CLI compatibility issues in CI. - The bootstrap installer now installs Node.js 24 when the current runtime is older than 24.11.0. - The portable sandbox fallback is pinned to Node.js 24.11.0 and depends on that upstream tarball remaining available. - Unsupported runtimes continue booting after a warning, so a later incompatibility can still fail at its point of use. - The CLI and server share the warning policy through the published `@paperclipai/shared` package; packaging checks must keep that subpath export available. - This PR does not commit `pnpm-lock.yaml` because repository policy assigns lockfile generation to CI. > For core feature work, check [`ROADMAP.md`](ROADMAP.md) first and discuss it in `#dev` before opening the PR. Feature PRs that overlap with planned core work may need to be redirected — check the roadmap first. See `CONTRIBUTING.md`. ## Model Used - OpenAI Codex based on GPT-5. The exact deployment ID and context window are not exposed in this session. Reasoning, repository tools, shell execution, and GitHub tools were enabled. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Paperclip <noreply@paperclip.ing> |
||
|
|
3abe9e2134 |
build(deps): bump zod from 3.25.76 to 4.4.3 (#11719)
Bumps [zod](https://github.com/colinhacks/zod) from 3.25.76 to 4.4.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/colinhacks/zod/releases">zod's releases</a>.</em></p> <blockquote> <h2>v4.4.3</h2> <h2>Commits:</h2> <ul> <li>4c2fa95ce3f3390fbc522324e406b4e9e89b88f9 docs: use Zernio primary wordmark for gold sponsor logo</li> <li>2aeec83eb135e3a83756e973ef44845fc5a455d2 docs: prune lapsed gold sponsors and rebalance logo sizing</li> <li>7391be88ac1ee5cd02057f5ccc012a1f5df4efd0 docs: prune lapsed silver/bronze sponsors and add active ones</li> <li>2c703322a21b4e2b12f33f49ea8430c451a68b4f docs: normalize bronze sponsor logos to github avatar pattern</li> <li>9195250cab0e7950efe39c3926d6c203b4b0a170 docs: remove Mintlify from bronze sponsors (churned)</li> <li>b8dffe9e62f17e6571e6249d05cc5102b54d94e4 docs: remove Numeric and Speakeasy (2+ missed monthly cycles)</li> <li>1cab69383fcdeae2a366d5e2a2fc4d8fc765d168 fix(v4): restore catch handling for absent object keys (<a href="https://redirect.github.com/colinhacks/zod/issues/5937">#5937</a>) (<a href="https://redirect.github.com/colinhacks/zod/issues/5939">#5939</a>)</li> <li>c2be4f819064eed62c7c350a2d399b5faecd15f8 fix(v4): generalize optin/fallback to transform; restore preprocess on absent keys (<a href="https://redirect.github.com/colinhacks/zod/issues/5941">#5941</a>)</li> <li>f3c9ec03ba7a28ae72d25cc295f38674bee0f559 4.4.3</li> <li>1fb56a5c18c27102dbc92260a4007c7732a0ccca docs: document release procedure in AGENTS.md</li> </ul> <h2>v4.4.2</h2> <h2>Commits:</h2> <ul> <li>0c62df0ea19fd05abdf90473e9eef7eea530fab2 Clean up docs navigation and stale labels (<a href="https://redirect.github.com/colinhacks/zod/issues/5901">#5901</a>)</li> <li>20cc794895cc8604fe0c87d83a5d1c3f89fad0ac chore: add security policy and refresh tooling deps</li> <li>6fbe07b0177efdd1bf1c0b05160e70d7a0702337 fix(docs): heading anchor links now include the hash so it doesnt scoll all the way up, follows navbar logic (<a href="https://redirect.github.com/colinhacks/zod/issues/5791">#5791</a>)</li> <li>4bbed1b1c73eca4ce9e59b1189ed236aa6c8b5bd Tighten discriminated union option typing</li> <li>bbac3e567e7fccfaaf7cdc97f1ce30c295e2c908 Update PR guidance for agents</li> <li>cf0dc942a32805c292fff59ade20a7ace980735a Merge remote-tracking branch 'origin/main' into fix-discriminated-union-key-constraint</li> <li>292c894a5fd2aa42e527900b83d8d7a3009a709c docs: add Zernio gold sponsor</li> <li>1fc9f311c28dcf80d0bb5a36b177086cbc3d8eca docs: document codec inversion</li> <li>1373c85da9aeff704a9762d27bc58699618aefb7 docs: remove AI disclosure guidance</li> <li>e20d02b473c08e3a4e557bc610b1b5fac079b649 chore: ignore triage notes</li> <li>e58ea4d91b1dfe8194b73508203213cbc7e9c936 docs: test Zod Mini tab code heights</li> <li>905761a5d127e8d5dd2ebb3bc88c75cb0b8149ff docs: document preprocess input type narrowing</li> <li>bf64bac850d4dee2b7dde7e64909d5d796d32043 chore: tighten test guidance in AGENTS.md</li> <li>8ec4e73f4c4693b6361ad591be40fb41eb8a9f95 chore: update play.ts scratch</li> <li>02c2baf7d0d615872fa4528a8020603b71211702 Make z.preprocess defer optionality to inner schema (<a href="https://redirect.github.com/colinhacks/zod/issues/5929">#5929</a>)</li> <li>88015df8e25c44fb5385eb3ef28935119cd5edea fix(docs): drop deprecated <code>baseUrl</code> from tsconfig</li> <li>c59d4474e3b4cad1b323462186cf607178ce8267 4.4.2</li> </ul> <h2>v4.4.1</h2> <h2>Commits:</h2> <ul> <li>481f7be4238c83ed58183f921b2646f340a91c6a ci: gate release publishing on full test workflow</li> <li>95ccab423aec720b2523c3a64cdc7e3204537cc7 test(v3): restore optional undefined expectations</li> <li>cede2c63739a5823d6aa5093d291e9a111da943d fix(v4): reject tuple holes before required defaults (<a href="https://redirect.github.com/colinhacks/zod/issues/5900">#5900</a>)</li> <li>edd0bf0f5ada4a8dc581c259407d7bbad0a71ea7 release: 4.4.1</li> <li>180d83d1dbe6a59260710cc8637a3dea2281ee56 docs: remove Jazz featured sponsor</li> </ul> <h2>v4.4.0</h2> <h2>4.4.0</h2> <p>This is a minor release with a wide set of correctness and soundness fixes. Some fixes intentionally make Zod stricter, so code that depended on previously accepted invalid or ambiguous inputs may need small updates.</p> <h2>Potentially breaking bug fixes</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/colinhacks/zod/commit/1fb56a5c18c27102dbc92260a4007c7732a0ccca"><code>1fb56a5</code></a> docs: document release procedure in AGENTS.md</li> <li><a href="https://github.com/colinhacks/zod/commit/f3c9ec03ba7a28ae72d25cc295f38674bee0f559"><code>f3c9ec0</code></a> 4.4.3</li> <li><a href="https://github.com/colinhacks/zod/commit/c2be4f819064eed62c7c350a2d399b5faecd15f8"><code>c2be4f8</code></a> fix(v4): generalize optin/fallback to transform; restore preprocess on absent...</li> <li><a href="https://github.com/colinhacks/zod/commit/1cab69383fcdeae2a366d5e2a2fc4d8fc765d168"><code>1cab693</code></a> fix(v4): restore catch handling for absent object keys (<a href="https://redirect.github.com/colinhacks/zod/issues/5937">#5937</a>) (<a href="https://redirect.github.com/colinhacks/zod/issues/5939">#5939</a>)</li> <li><a href="https://github.com/colinhacks/zod/commit/b8dffe9e62f17e6571e6249d05cc5102b54d94e4"><code>b8dffe9</code></a> docs: remove Numeric and Speakeasy (2+ missed monthly cycles)</li> <li><a href="https://github.com/colinhacks/zod/commit/9195250cab0e7950efe39c3926d6c203b4b0a170"><code>9195250</code></a> docs: remove Mintlify from bronze sponsors (churned)</li> <li><a href="https://github.com/colinhacks/zod/commit/2c703322a21b4e2b12f33f49ea8430c451a68b4f"><code>2c70332</code></a> docs: normalize bronze sponsor logos to github avatar pattern</li> <li><a href="https://github.com/colinhacks/zod/commit/7391be88ac1ee5cd02057f5ccc012a1f5df4efd0"><code>7391be8</code></a> docs: prune lapsed silver/bronze sponsors and add active ones</li> <li><a href="https://github.com/colinhacks/zod/commit/2aeec83eb135e3a83756e973ef44845fc5a455d2"><code>2aeec83</code></a> docs: prune lapsed gold sponsors and rebalance logo sizing</li> <li><a href="https://github.com/colinhacks/zod/commit/4c2fa95ce3f3390fbc522324e406b4e9e89b88f9"><code>4c2fa95</code></a> docs: use Zernio primary wordmark for gold sponsor logo</li> <li>Additional commits viewable in <a href="https://github.com/colinhacks/zod/compare/v3.25.76...v4.4.3">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for zod since your current version.</p> </details> <br /> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Priya Raman <priya@paperclip.ing> Co-authored-by: Paperclip <noreply@paperclip.ing> |
||
|
|
f674f2ca31 |
build(deps): bump chokidar from 4.0.3 to 5.0.0 (#11720)
Bumps [chokidar](https://github.com/paulmillr/chokidar) from 4.0.3 to 5.0.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/paulmillr/chokidar/releases">chokidar's releases</a>.</em></p> <blockquote> <h2>5.0.0</h2> <ul> <li>Make the package ESM-only. Reduces on-disk package size from ~150kb to ~80kb</li> <li>Increase minimum node.js version to v20.19. The versions starting from it support loading esm files from cjs</li> <li>fix: Make types more precise <a href="https://redirect.github.com/paulmillr/chokidar/pull/1424">paulmillr/chokidar#1424</a></li> <li>perf: re-use double slash regex <a href="https://redirect.github.com/paulmillr/chokidar/pull/1435">paulmillr/chokidar#1435</a></li> <li>Update readdirp to ESM-only v5</li> <li>Lots of minor improvements in tests</li> <li>Increase security of NPM releases. Switch to token-less Trusted Publishing, with help of <a href="https://github.com/paulmillr/jsbt">jsbt</a></li> <li>Switch compilation mode to isolatedDeclaration-based typescript for simplified auto-generated docs</li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/mhkeller"><code>@mhkeller</code></a> made their first contribution in <a href="https://redirect.github.com/paulmillr/chokidar/pull/1426">paulmillr/chokidar#1426</a></li> <li><a href="https://github.com/btea"><code>@btea</code></a> made their first contribution in <a href="https://redirect.github.com/paulmillr/chokidar/pull/1432">paulmillr/chokidar#1432</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/paulmillr/chokidar/compare/4.0.3...5.0.0">https://github.com/paulmillr/chokidar/compare/4.0.3...5.0.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/paulmillr/chokidar/commit/c0c8d20e49d337491891078d1081bf91bd178de6"><code>c0c8d20</code></a> Release 5.0.0.</li> <li><a href="https://github.com/paulmillr/chokidar/commit/b211ceca34b1d30326334de21ed30b4a4ceb4c7e"><code>b211cec</code></a> Remove src from npm</li> <li><a href="https://github.com/paulmillr/chokidar/commit/87422468fd353426a53a78788b8718979c8725cc"><code>8742246</code></a> Upgrade dev deps, jsbt, ci files. Upgrade readdirp to v5.</li> <li><a href="https://github.com/paulmillr/chokidar/commit/de5a34c3cccf2d6fc812a6080e29fb4dd1583ec1"><code>de5a34c</code></a> Merge pull request <a href="https://redirect.github.com/paulmillr/chokidar/issues/1442">#1442</a> from paulmillr/flaky-buns</li> <li><a href="https://github.com/paulmillr/chokidar/commit/c08a6c4ed6a67b2cb16f61592f763b33e6bce7d3"><code>c08a6c4</code></a> fix: throttle based on dir + target</li> <li><a href="https://github.com/paulmillr/chokidar/commit/0c55ab3b049682fae9c1ee278ebc964dbfb92f08"><code>0c55ab3</code></a> test: wait for explicit calls in directory test</li> <li><a href="https://github.com/paulmillr/chokidar/commit/ce81be5a51ae72920649e2a74aeba86688c2a5ee"><code>ce81be5</code></a> perf: re-use double slash regex (<a href="https://redirect.github.com/paulmillr/chokidar/issues/1435">#1435</a>)</li> <li><a href="https://github.com/paulmillr/chokidar/commit/7d9c1ed27d2b9150077601677a8a8bad27b8f3da"><code>7d9c1ed</code></a> Merge pull request <a href="https://redirect.github.com/paulmillr/chokidar/issues/1433">#1433</a> from paulmillr/super-matrices</li> <li><a href="https://github.com/paulmillr/chokidar/commit/391554143f582fe78f7d37cf54b834c42f84652b"><code>3915541</code></a> Merge pull request <a href="https://redirect.github.com/paulmillr/chokidar/issues/1430">#1430</a> from paulmillr/esm-only</li> <li><a href="https://github.com/paulmillr/chokidar/commit/9308bedee986abac912100e4bcc4823a1504a10f"><code>9308bed</code></a> chore: use Nodejs 24 in CI (<a href="https://redirect.github.com/paulmillr/chokidar/issues/1432">#1432</a>)</li> <li>Additional commits viewable in <a href="https://github.com/paulmillr/chokidar/compare/4.0.3...5.0.0">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for chokidar since your current version.</p> </details> <br /> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Priya Raman <priya@paperclip.ing> Co-authored-by: Paperclip <noreply@paperclip.ing> |
||
|
|
233c12f029 |
feat: add kimi-local adapter for Kimi Code CLI (CLI + ACP engines) (#9967)
## Thinking Path > - Paperclip is the open source app people use to manage AI agents for work > - Local agent adapters (`claude_local`, `gemini_local`, `grok_local`, …) are the integration surface that lets Paperclip run coding CLIs on the host machine > - The Kimi Code CLI (`kimi`, Moonshot AI) has a documented non-interactive mode, `kimi -p --output-format stream-json` with session resume via `kimi -r`, but Paperclip has no built-in adapter for it > - So Kimi users (especially Kimi membership / OAuth subscribers) cannot onboard their CLI to Paperclip agent teams > - This pull request adds a complete built-in `kimi_local` adapter (both execution engines, session management, instructions + skills delivery, thinking-effort control, environment test, UI and CLI modules, docs) following the established `gemini_local`/`grok_local` package pattern > - Kimi Code ships an ACP server (`kimi acp`), so the adapter runs on Paperclip's shared acpx engine by default (streaming transcript with live tool status, like `claude_local`/`gemini_local`) and falls back to a headless CLI lane (`kimi -p --output-format stream-json`) when ACP prerequisites are unavailable > - The benefit is that Kimi Code becomes a first-class Paperclip agent lane: selectable in the UI, resumable across heartbeats, with the same operating context (instruction bundle, skills, effort) and streaming transcript the other local adapters get ## Linked Issues or Issue Description - Supersedes #9880 (same branch; expanded from the CLI-only lane into a complete adapter with the default ACP engine lane, control-plane skill install, and live transcript wiring) - Refs #9879 (adapter request for Kimi Code CLI, filed with this PR) - Refs #163 (original Kimi support request) Duplicate/related prior PRs, per the dedup search (both appear stale: no updates or maintainer review since May 2026, and both target an older Kimi CLI interface; calling them out for reviewer context per CONTRIBUTING.md): - Refs #6276 (`feat: add kimi-local adapter`): targets an older array-based content format (`{type: think}`/`{type: text}` blocks), not the current documented stream-json schema - Refs #5202 (`feat(adapter): add Kimi CLI local adapter with Wire protocol support`): builds on a `--wire` JSON-RPC interface that current Kimi Code CLI (0.27.0) no longer documents; the current documented headless interface is `-p --output-format stream-json` This PR is a fresh implementation against current master and the currently documented/verified Kimi CLI behavior (see Verification). Happy to fold in anything useful from the earlier attempts if a reviewer prefers. ## What Changed - **New adapter package** `packages/adapters/kimi-local` (`@paperclipai/adapter-kimi-local`), modeled on `gemini-local`/`grok-local`: - `src/server/execute.ts`: spawns `kimi -p <prompt> --output-format stream-json` (argv array, no shell), `-m <model>` only when configured, `-r <sessionId>` when the stored session cwd matches the run cwd, automatic fresh-session retry on unrecoverable-session errors, headless-safe env (`CI=1`, `NO_COLOR=1`, `KIMI_CODE_NO_AUTO_UPDATE=1`, `TERM=dumb`; user-configured values win), full remote (ssh/sandbox) execution lane with runtime install via `@moonshot-ai/kimi-code` - **Instruction bundle delivery**: the prompt path directive now names the sibling instruction files (`./HEARTBEAT.md`, `./SOUL.md`, `./TOOLS.md`) alongside the prepended entry file, and local runs pass `--add-dir <instructions-dir>` so Kimi can actually open them (matching `claude_local`). Without this, only the entry file reached Kimi and agents improvised the operating workflow that `HEARTBEAT.md` documents - **Thinking effort**: a configured `effort` is forwarded as the `KIMI_MODEL_THINKING_EFFORT` operational override (Kimi has no per-invocation effort flag). It is only sent for models that advertise `support_efforts` (currently `kimi-code/k3`) to avoid provider rejections, and `medium` maps to `high` since Kimi has no medium tier (`low`/`high`/`max` pass through) - **Skills delivery**: desired Paperclip skills are delivered via Kimi's `--skills-dir` flag from a dedicated per-run directory (a local snapshot, or the synced snapshot on remote targets), so skills load reliably and in isolation. Paperclip never overwrites the shared `$KIMI_CODE_HOME/skills` home, so skills installed by the operator or other agents are left intact. `--skills-dir` is only passed when at least one skill is desired, so unconfigured agents keep Kimi's default skill discovery - **Live run status**: the adapter now forwards each streamed stream-json line to `onEvent` (assistant `content` as an assistant snippet, `tool_calls` as tool-name events), which drives the issue-thread activity indicator (`currentToolName` / `lastAssistantSnippet` / `lastEventAt`). Previously the adapter only wrote the raw run log, so the issue thread showed a stale "no output for N s" line with no tool or reasoning context while Kimi worked. Tool results are omitted so the last meaningful "Using X" / snippet is not overwritten by a generic label - `src/server/parse.ts`: parses the verified Kimi stream-json event shapes (`assistant` text, `assistant.tool_calls` with JSON-string arguments, `tool` results, trailing `meta.session.resume_hint` for session-id capture) plus failure classifiers (`kimi_auth_required`, transient network, unrecoverable session). A signaled exit (null exit code, not a timeout) is now reported as a failure rather than coalesced to success, and the error message names the terminating signal - `src/server/skills.ts`: lists/syncs Paperclip skills for the adapter's skill-management surface - `src/server/test.ts`: environment test covering CLI resolution + `kimi --version`, cwd check, auth detection (OAuth credential dirs, keyed `[providers.*]` in config.toml, or the `KIMI_MODEL_NAME` + `KIMI_MODEL_API_KEY` env pair), and a live hello probe - `src/ui/` (stdout-line parser for transcripts, config builder) and `src/cli/` (stream event formatter) modules - Root metadata: three managed model aliases (`kimi-code/kimi-for-coding`, `kimi-code/kimi-for-coding-highspeed`, `kimi-code/k3`), effort-capable-model metadata (`EFFORT_CAPABLE_MODELS`, effort mapping helpers), `agentConfigurationDoc` - Tests: 101 tests across parse, execute (args building, resume gating, retry, auth error code, timeout, signaled-exit failure, effort forwarding/gating/mapping, `--add-dir` instructions directive, `--skills-dir` gating, `onEvent` runtime-event forwarding), ACP engine (engine resolution, acpx config build, node-version gate), ACP transcript delegation, environment test, UI parse/build-config - **ACP engine lane (default)** (`src/server/acp.ts` + shared `adapter-utils/acpx-engine`): Kimi Code ships an ACP server (`kimi acp`), so `kimi_local` now runs on Paperclip's shared acpx engine by default, matching `claude_local`/`codex_local`/`gemini_local`. The issue-thread transcript streams live (assistant text deltas, tool calls with a `pending`->`completed` status lifecycle) instead of the CLI lane's bursty complete-message output. Registered `kimi_local -> "kimi"` in `ACPX_ADAPTER_AGENT_IDS` and resolved the built-in agent command to `kimi acp`; `execute.ts` dispatches to the ACP executor first with an automatic CLI fallback when ACP prerequisites fail (`engine=acp` requires ACP, `engine=cli` pins the headless lane); `index.ts` falls back to the shared acpx session codec; the UI/CLI delegate `acpx.*` events to the shared acpx transcript parser and event formatter. The headless CLI lane (above) remains as the fallback - **Registration** (one entry each, mirroring existing adapters): server adapter registry + `BUILTIN_ADAPTER_TYPES`, `AGENT_ADAPTER_TYPES` (shared), UI adapter registry + display registry (`Kimi Code`, Moon icon) + capabilities defaults, CLI adapter registry, `Dockerfile` (package copy + `npm install --global @moonshot-ai/kimi-code@latest`), `vitest.config.ts` workspace, `scripts/release-package-manifest.json` - **Behavioral sets** mirroring `gemini_local` (Kimi resumes sessions the same way): `GIT_SENSITIVE_LOCAL_ADAPTER_TYPES`, `SESSIONED_LOCAL_ADAPTERS` (heartbeat + recovery), `REMOTE_MANAGED_ADAPTERS`, ssh/sandbox execution-target allow-lists, `ADAPTER_DEFAULT_RULES_BY_TYPE` (`timeoutSec: 0`, `graceSec: 15`), and `LEGACY_SESSIONED_ADAPTER_TYPES` + `ADAPTER_SESSION_MANAGEMENT` in adapter-utils - **UI touch-points**: New Agent default-model branch, AgentConfigForm command map (`kimi_local: "kimi"`) + model defaults + a Kimi-specific thinking-effort option list (`Low`/`High`/`Max`, reflecting Kimi's tiers rather than borrowing Claude's), OnboardingWizard (command map, model default, `kimi login` / `KIMI_MODEL_NAME + KIMI_MODEL_API_KEY` auth hints, manual-debug command line), InviteLanding enabled adapters - **Control-plane skill install** (`cli/src/commands/client/agent.ts`): `paperclipai agent local-cli` seeded the Paperclip control-plane skills into `~/.codex/skills` and `~/.claude/skills` so Codex/Claude agents auto-discover the API reference every run. Kimi had no equivalent target, so `kimi_local` agents began each session without the control-plane skill and rediscovered routes (e.g. the company-scoped `POST /api/companies/{companyId}/issues`) by trial and error. Added `~/.kimi-code/skills` (honoring `KIMI_CODE_HOME`) as a third install target for parity. Independent of the per-run `--skills-dir` delivery, which only applies to explicitly configured skills. - **Docs**: `docs/adapters/kimi-local.md` (prerequisites, auth options, config fields including `effort`, session resume, instruction bundle, skills delivery, control-plane skill install) + a row in `docs/adapters/overview.md` Out of scope (deliberately): model profiles, built-in agent `allowedAdapterTypes` additions. ## Verification\n\nCurrent-master rebase verification (OpenAI Codex, 2026-08-03): 13 focused files / 231 tests pass; adapter-utils, server, UI, CLI, and Kimi adapter typechecks pass; full repository build and UI token gates pass. The branch is conflict-free against master at head `1249df117c5e12e5771b9a570a6340866450619e`.\n\nAutomated (all from repo root, pnpm 9.15.4, Node 22): - `vitest run packages/adapters/kimi-local`: 89/89 pass (includes coverage for the instruction `--add-dir` directive, effort forwarding/gating/mapping, `--skills-dir` gating, the signaled-exit failure path, and `onEvent` runtime-event forwarding with cross-chunk line buffering) - `vitest run server/src/__tests__/adapter-registry.test.ts server/src/__tests__/adapter-routes.test.ts server/src/services/heartbeat-stop-metadata.test.ts ui/src/adapters/adapter-display-registry.test.ts`: 37/37 pass - `vitest run cli/src/__tests__/skills.test.ts`: 13/13 pass (the control-plane skill install target follows the existing Codex/Claude install path, whose symlink logic is unchanged) - `vitest run packages/shared`: 307/307 pass; `vitest run packages/adapter-utils`: pass except one pre-existing, unrelated failure (`mcp-isolation.integration.test.ts` requires Claude CLI ≥ 2.1.207; host has 2.1.185, fails identically on unmodified master) - `pnpm --filter @paperclipai/adapter-kimi-local typecheck|build`, plus typecheck of `server`, `ui`, `cli`, `adapter-utils`: all clean - `pnpm install --frozen-lockfile`: passes (the PR diff itself contains no lockfile changes, per repo policy; verified against a locally regenerated lockfile) - `node scripts/check-no-git-push.mjs` and `node scripts/check-forbidden-tokens.mjs`: pass - CI note: the `policy` job's release-bootstrap step is expected to stay red until a maintainer bootstraps the first npm publish of `@paperclipai/adapter-kimi-local`; see the CI Note for Maintainers comment. All other contributor-actionable checks are green. Manual end-to-end (real Kimi CLI 0.27.0, OAuth login, dev server on an isolated instance): 1. Server `GET /api/adapters` lists `kimi_local` as builtin with correct capability flags; models endpoint returns the three Kimi models 2. `POST .../adapters/kimi_local/test-environment`: all checks pass, including a live `kimi -p` hello probe 3. Created a `kimi_local` agent and invoked two heartbeats: run 1 spawned `kimi -p ... --output-format stream-json`, Kimi used its `Read` tool, produced the expected answer, and the session id was captured from the `session.resume_hint` meta event; run 2 resumed the **same** Kimi session (`sessionIdBefore == sessionIdAfter`) via `-r` 4. UI: adapter appears in the New Agent dropdown; selecting it shows the Kimi command placeholder, the three models, and the Kimi config fields; the run transcript renders Kimi tool calls via the adapter's stdout parser The instruction-bundle, thinking-effort, and `--skills-dir` changes landed after the manual run above. They are covered by the unit tests listed under Automated, and the Kimi CLI flags they rely on (`--add-dir`, `--skills-dir`, `KIMI_MODEL_THINKING_EFFORT`) were confirmed against the installed Kimi Code CLI 0.27.0 (`kimi --help`, config-file thinking-effort docs). Screenshots (assets branch on the fork, not part of the diff):       ## Risks - Low risk to existing behavior: the change is additive, one new workspace package plus single-entry registrations alongside existing adapters; no existing adapter code paths are modified. - The adapter invokes the locally installed `kimi` CLI; like other local adapters, run behavior depends on the host's Kimi version. The parser is written against the documented/verified 0.27.0 stream-json schema and degrades gracefully (malformed lines are skipped, failures surface as run errors). - `--skills-dir` overrides Kimi's auto-discovery of user and project skills for the run. This is intentional (paperclip-managed agents get a reproducible, isolated skill set), and it is only passed when at least one Paperclip skill is desired, so unconfigured agents keep default discovery. - Thinking effort is only forwarded to models that advertise `support_efforts` (currently `kimi-code/k3`); `EFFORT_CAPABLE_MODELS` must be extended when more Kimi models gain support, otherwise a configured effort is silently ignored for them. - `Dockerfile` now installs `@moonshot-ai/kimi-code@latest` globally alongside the other agent CLIs, so image size increases slightly. - Maintainer action needed for the npm bootstrap gate: the `policy` job's release-bootstrap step fails until the first npm publish of `@paperclipai/adapter-kimi-local` (the gate from #5146 that every new adapter package has passed through). Enrollment with `publishFromCi: true` is required by the manifest validator (dropping the entry, `false`, or `private` are all rejected), so this is intentionally left to a maintainer. Remaining CI lanes are expected to run once it is done. ## Model Used\n\n- **Current-master rebase, conflict adaptation, and registry-parity coverage:** OpenAI, **GPT-5 Codex** (Codex agent; exact serving model ID and context-window size were not exposed to the runtime), with repository, shell, Git, and GitHub tooling. It preserved Hawik’s commit authorship, reconciled ACPX and environment-capability changes, added current registry tests, and ran the verification above.\n- **Adapter implementation and initial review:** Moonshot AI, **Kimi K3 Coding** (latest), via **Kimi Code CLI v0.27.0** (`kimi-code/k3` alias, 1M-token context window, thinking mode, agentic tool use). The CLI agent explored the repo, wrote the adapter implementation (delegated to a coder sub-agent of the same model), ran tests, and drafted the first version of this PR body. A second model-driven review pass (read-only, same model) audited the diff for security/correctness before submission; its findings (shell-quoting hardening, auth-detection false positive, session-compaction registration, test gaps) were fixed and are included. - **Harness-context fixes and review responses:** Anthropic, **Claude Opus 4.8** (`claude-opus-4-8`) via Claude Code. Diagnosed from run logs that Kimi received only the entry instructions file (not the `HEARTBEAT.md`/`SOUL.md`/`TOOLS.md` bundle) and that `effort` was never wired, then implemented the instruction `--add-dir` delivery, `KIMI_MODEL_THINKING_EFFORT` forwarding, and `--skills-dir` skill delivery, added the accompanying tests and docs, and addressed the automated review comments (preserving external skills on remote sync, treating a signaled exit as a failure). Also extended the `paperclipai agent local-cli` installer to seed the control-plane skills into `~/.kimi-code/skills` for Codex/Claude parity, wired `onEvent` runtime events so the issue-thread activity indicator reflects Kimi's tool and reasoning output live, and built the ACP engine lane (`kimi acp` via the shared acpx engine, default) so the transcript streams with live tool status like the other ACP adapters. The Kimi CLI flags, subcommand, and env var relied on here were verified against the installed Kimi Code CLI 0.27.0. - All CLI behaviors claimed here (`-p`, `--output-format stream-json`, `-r` resume, event shapes, `--add-dir`, `--skills-dir`, `KIMI_MODEL_THINKING_EFFORT`) were verified empirically against the installed Kimi CLI, not assumed. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] All Paperclip CI gates are green *(only the release-bootstrap step remains red, pending the maintainer npm publish described in Risks)* - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups *(will address all Greptile comments as they arrive)* - [x] I will address all Greptile and reviewer comments before requesting merge --- ## Maintainer Addendum (2026-08-20) The shared acpx-engine and issue-chat changes (run-summary segmentation, placeholder tool-event coalescing, `ISSUE_CHAT_TRANSCRIPT_MAX_VISIBLE_ENTRIES` 30 → 400, live-reasoning UI) have been **extracted to #11761** so the cross-adapter behavior changes review and revert independently — both commits there preserve @hawikk's authorship. This PR is now the kimi-specific adapter only (60 files, +3,793/−8, essentially pure addition); the only shared-engine touch left is the `kimi acp` command resolution. `publishFromCi` is `true` — the package name is bootstrapped on npm. --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> Co-authored-by: Paperclip <noreply@paperclip.ing> Co-authored-by: Dotta <bippadotta@protonmail.com> Co-authored-by: Devin Foley <devin@paperclip.ing> |
||
|
|
54b8bec444 |
build(deps): bump pino-http from 10.5.0 to 11.0.0 (#11716)
Bumps [pino-http](https://github.com/pinojs/pino-http) from 10.5.0 to 11.0.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pinojs/pino-http/releases">pino-http's releases</a>.</em></p> <blockquote> <h2>v11.0.0</h2> <h2>What's Changed</h2> <ul> <li>build(deps-dev): bump <code>@types/node</code> from 22.15.32 to 24.0.3 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/pinojs/pino-http/pull/370">pinojs/pino-http#370</a></li> <li>build(deps-dev): bump typescript from 5.8.3 to 5.9.2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/pinojs/pino-http/pull/373">pinojs/pino-http#373</a></li> <li>build(deps-dev): bump tsd from 0.32.0 to 0.33.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/pinojs/pino-http/pull/376">pinojs/pino-http#376</a></li> <li>build(deps): bump actions/checkout from 4 to 5 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/pinojs/pino-http/pull/380">pinojs/pino-http#380</a></li> <li>build(deps): bump actions/setup-node from 4 to 5 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/pinojs/pino-http/pull/382">pinojs/pino-http#382</a></li> <li>Update for pino@10 by <a href="https://github.com/jsumners"><code>@jsumners</code></a> in <a href="https://redirect.github.com/pinojs/pino-http/pull/383">pinojs/pino-http#383</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/pinojs/pino-http/compare/v10.5.0...v11.0.0">https://github.com/pinojs/pino-http/compare/v10.5.0...v11.0.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pinojs/pino-http/commit/6615953a8bfebf37c26e6438568724a091f80a82"><code>6615953</code></a> v11.0.0</li> <li><a href="https://github.com/pinojs/pino-http/commit/da0442ea7306b0560eada975391d13853c72b119"><code>da0442e</code></a> Update for pino@10 (<a href="https://redirect.github.com/pinojs/pino-http/issues/383">#383</a>)</li> <li><a href="https://github.com/pinojs/pino-http/commit/c77bf2546d44dbe7381264955ae97ca76ff302e1"><code>c77bf25</code></a> build(deps): bump actions/setup-node from 4 to 5 (<a href="https://redirect.github.com/pinojs/pino-http/issues/382">#382</a>)</li> <li><a href="https://github.com/pinojs/pino-http/commit/5b06a223d3ad15f97b1e0f68416410776c47fdde"><code>5b06a22</code></a> build(deps): bump actions/checkout from 4 to 5 (<a href="https://redirect.github.com/pinojs/pino-http/issues/380">#380</a>)</li> <li><a href="https://github.com/pinojs/pino-http/commit/bc69ee95e184f882570c7a9d551288b5b077fe02"><code>bc69ee9</code></a> build(deps-dev): bump tsd from 0.32.0 to 0.33.0 (<a href="https://redirect.github.com/pinojs/pino-http/issues/376">#376</a>)</li> <li><a href="https://github.com/pinojs/pino-http/commit/c2ccdb31d8961033c976686102f7d6279f97a1c2"><code>c2ccdb3</code></a> build(deps-dev): bump typescript from 5.8.3 to 5.9.2 (<a href="https://redirect.github.com/pinojs/pino-http/issues/373">#373</a>)</li> <li><a href="https://github.com/pinojs/pino-http/commit/6dbe316bd5d8860a3efbc963e5b6fed7a4b45384"><code>6dbe316</code></a> build(deps-dev): bump <code>@types/node</code> from 22.15.32 to 24.0.3 (<a href="https://redirect.github.com/pinojs/pino-http/issues/370">#370</a>)</li> <li>See full diff in <a href="https://github.com/pinojs/pino-http/compare/v10.5.0...v11.0.0">compare view</a></li> </ul> </details> <br /> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Priya Raman <priya@paperclip.ing> Co-authored-by: Paperclip <noreply@paperclip.ing> |
||
|
|
416a273366 |
build(deps): bump jsdom and @types/jsdom (#11717)
Bumps [jsdom](https://github.com/jsdom/jsdom) and [@types/jsdom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/jsdom). These dependencies needed to be updated together. Updates `jsdom` from 28.1.0 to 30.0.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/jsdom/jsdom/releases">jsdom's releases</a>.</em></p> <blockquote> <h2>v30.0.1</h2> <ul> <li>Fixed <code>getComputedStyle()</code> with <code>calc()</code> and other functions throwing an exception, which regressed in v30.0.0. (<a href="https://github.com/asamuzaK"><code>@asamuzaK</code></a>)</li> <li>Sped up up range operations on large documents (<a href="https://github.com/leonidaz"><code>@leonidaz</code></a>)</li> </ul> <h2>v30.0.0</h2> <p>Breaking changes:</p> <ul> <li>Node.js minimum version raised to <code>^22.22.2 || ^24.15.0 || >=26.0.0</code>.</li> </ul> <p>Other changes:</p> <ul> <li>Added <code>CSS.escape()</code> and <code>CSS.supports()</code> functions. (<a href="https://github.com/asamuzaK"><code>@asamuzaK</code></a>)</li> <li>Added <code>'background-position-x'</code> and <code>'background-position-y'</code> CSS properties. (<a href="https://github.com/olagokemills"><code>@olagokemills</code></a>)</li> <li>Fixed <code>getComputedStyle()</code> to convert length values into pixels. (<a href="https://github.com/asamuzaK"><code>@asamuzaK</code></a>)</li> <li>Fixed CSS function serialization, e.g., in the return value of <code>getPropertyValue()</code>. (<a href="https://github.com/asamuzaK"><code>@asamuzaK</code></a>)</li> <li>Fixed the type of error thrown by <code>document.evaluate()</code> (<a href="https://github.com/dokson"><code>@dokson</code></a>)</li> </ul> <h2>v29.1.1</h2> <ul> <li>Fixed <code>'border-radius'</code> computed style serialization. (<a href="https://github.com/asamuzaK"><code>@asamuzaK</code></a>)</li> <li>Fixed computed style computation when using <code>'background-origin'</code> and <code>'background-clip'</code> CSS properties. (<a href="https://github.com/asamuzaK"><code>@asamuzaK</code></a>)</li> <li>Significantly optimized initial calls to <code>getComputedStyle()</code>, before the cache warms up. (<a href="https://github.com/asamuzaK"><code>@asamuzaK</code></a>)</li> </ul> <h2>v29.1.0</h2> <ul> <li>Added basic support for the ratio CSS type. (<a href="https://github.com/asamuzaK"><code>@asamuzaK</code></a>)</li> <li>Fixed <code>getComputedStyle()</code> sometimes returning outdated results after CSS was modified. (<a href="https://github.com/asamuzaK"><code>@asamuzaK</code></a>)</li> </ul> <h2>v29.0.2</h2> <ul> <li>Significantly improved and sped up <code>getComputedStyle()</code>. Computed value rules are now applied across a broader set of properties, and include fixes related to inheritance, defaulting keywords, custom properties, and color-related values such as <code>currentcolor</code> and system colors. (<a href="https://github.com/asamuzaK"><code>@asamuzaK</code></a>)</li> <li>Fixed CSS <code>'background</code>' and <code>'border'</code> shorthand parsing. (<a href="https://github.com/asamuzaK"><code>@asamuzaK</code></a>)</li> </ul> <h2>v29.0.1</h2> <ul> <li>Fixed CSS parsing of <code>'border'</code>, <code>'background'</code>, and their sub-shorthands containing keywords or <code>var()</code>. (<a href="https://github.com/asamuzaK"><code>@asamuzaK</code></a>)</li> <li>Fixed <code>getComputedStyle()</code> to return a more functional <code>CSSStyleDeclaration</code> object, including indexed access support, which regressed in v29.0.0.</li> </ul> <h2>v29.0.0</h2> <p>Breaking changes:</p> <ul> <li>Node.js v22.13.0+ is now the minimum supported v22 version (was v22.12.0+).</li> </ul> <p>Other changes:</p> <ul> <li>Overhauled the CSSOM implementation, replacing the <a href="https://www.npmjs.com/package/@acemir/cssom"><code>@acemir/cssom</code></a> and <a href="https://github.com/jsdom/cssstyle"><code>cssstyle</code></a> dependencies with fresh internal implementations built on webidl2js wrappers and the <a href="https://www.npmjs.com/package/css-tree"><code>css-tree</code></a> parser. Serialization, parsing, and API behavior is improved in various ways, especially around edge cases.</li> <li>Added <code>CSSCounterStyleRule</code> and <code>CSSNamespaceRule</code> to jsdom <code>Window</code>s.</li> <li>Added <code>cssMediaRule.matches</code> and <code>cssSupportsRule.matches</code> getters.</li> <li>Added proper media query parsing in <code>MediaList</code>, using <code>css-tree</code> instead of naive comma-splitting. Invalid queries become <code>"not all"</code> per spec.</li> <li>Added <code>cssKeyframeRule.keyText</code> getter/setter validation.</li> <li>Added <code>cssStyleRule.selectorText</code> setter validation: invalid selectors are now rejected.</li> <li>Added <code>styleSheet.ownerNode</code>, <code>styleSheet.href</code>, and <code>styleSheet.title</code>.</li> <li>Added bad port blocking per the <a href="https://fetch.spec.whatwg.org/#bad-port">fetch specification</a>, preventing fetches to commonly-abused ports.</li> <li>Improved <code>Document</code> initialization performance by lazily initializing the CSS selector engine, avoiding ~0.5 ms of overhead per <code>Document</code>. (<a href="https://github.com/thypon"><code>@thypon</code></a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/jsdom/jsdom/commit/6584485f094d5b271553005b68804c93a455c002"><code>6584485</code></a> 30.0.1</li> <li><a href="https://github.com/jsdom/jsdom/commit/0c51df6d80567202e969ba273c32db01de43c26e"><code>0c51df6</code></a> Update dependencies and dev dependencies</li> <li><a href="https://github.com/jsdom/jsdom/commit/32adb340bf3782194099c6a7b0e0a34c05aa8f24"><code>32adb34</code></a> Bump <code>@asamuzakjp/dom-selector</code></li> <li><a href="https://github.com/jsdom/jsdom/commit/70f014aa1de06a684b4f7d123bdb832ae8c63c53"><code>70f014a</code></a> Speed up range operations on large documents</li> <li><a href="https://github.com/jsdom/jsdom/commit/250d7ee387109d9674d3e4a79fe1edac96e45476"><code>250d7ee</code></a> Partially fix getComputedStyle with calc()</li> <li><a href="https://github.com/jsdom/jsdom/commit/20a01fc4a5ca1b2a48ec9c546d230624964d2f83"><code>20a01fc</code></a> 30.0.0</li> <li><a href="https://github.com/jsdom/jsdom/commit/8c8e583c4f0130f09a1f0ba2728c9aebc4f709c5"><code>8c8e583</code></a> Precompute WPT expectation matches</li> <li><a href="https://github.com/jsdom/jsdom/commit/f32245cfedf894b933bf4625b5649c284422da45"><code>f32245c</code></a> Bump Node.js floor and dependencies</li> <li><a href="https://github.com/jsdom/jsdom/commit/03ef23b4513af92d89d59b2383c5697a0a260111"><code>03ef23b</code></a> Add background-position longhands</li> <li><a href="https://github.com/jsdom/jsdom/commit/ded056f38de1a1e3709feafd0acea57377f85f35"><code>ded056f</code></a> Test CSS.escape() with numeric IDs</li> <li>Additional commits viewable in <a href="https://github.com/jsdom/jsdom/compare/v28.1.0...v30.0.1">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for jsdom since your current version.</p> </details> <details> <summary>Install script changes</summary> <p>This version modifies <code>prepare</code> script that runs during installation. Review the package contents before updating.</p> </details> <br /> Updates `@types/jsdom` from 28.0.0 to 30.0.0 <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/jsdom">compare view</a></li> </ul> </details> <br /> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Priya Raman <priya@paperclip.ing> Co-authored-by: Paperclip <noreply@paperclip.ing> |
||
|
Nicky LeachandPaperclip
|
5a1ce7aed8 |
fix(server): stamp built commit into service.version (#11748)
## Thinking Path > - Paperclip is the open source app people use to manage AI agents for work > - The server emits OpenTelemetry spans so operators can trace agent work > - Each span needs a service version that identifies the code that produced it > - The current service version comes from a static environment value and can become stale after a rebuild > - This pull request records the built commit and resolves the service version from the build stamp, runtime Git, the environment, or an unknown fallback > - The benefit is trace data that identifies the correct built commit during development and deployment ## Linked Issues or Issue Description **What happened?** The server used a static `OTEL_SERVICE_VERSION` value for every OpenTelemetry span. Rebuilds could produce traces with an old commit value. **Expected behavior** The server should report the built commit when a build stamp exists. It should use runtime Git, the environment value, or `unknown` as fallback. **Steps to reproduce** 1. Set `OTEL_SERVICE_VERSION` to an old commit value. 2. Build the server at a different commit. 3. Start the server and inspect the OpenTelemetry service version. 4. Confirm that the built commit takes precedence over the old environment value. ## What Changed - Add a build script that writes the short Git commit to `dist/build-info.json`. - Resolve `service.version` from the build stamp, runtime Git, the environment, or `unknown`. - Log the resolved service version once during server startup. - Add tests for the resolution order and safe behavior without Git. - Document the resolution order in `doc/observability.md`. ## Verification - `pnpm --filter @paperclipai/server build` - `npx vitest run server/src/__tests__/service-version.test.ts` - `pnpm --filter @paperclipai/server typecheck` - Confirm that the build stamp contains the short commit. - Confirm that the stamp wins over the environment value. - Confirm that a build without Git exits successfully without a stamp. ## Risks The server now prefers the built commit over `OTEL_SERVICE_VERSION`. A build without Git uses the existing environment value or `unknown`. The change needs no schema migration and has a single-commit rollback path. ## Model Used OpenAI Codex, GPT-5, tool use and code execution. The runtime does not expose the context window size or reasoning mode. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Paperclip <noreply@paperclip.ing> |
||
|
dependabot[bot]
|
433b1eb099 |
build(deps): bump @aws-sdk/client-s3 from 3.1106.0 to 3.1111.0 (#11714)
Bumps [@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3) from 3.1106.0 to 3.1111.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/aws/aws-sdk-js-v3/releases">@aws-sdk/client-s3's releases</a>.</em></p> <blockquote> <h2>v3.1111.0</h2> <h4>3.1111.0(2026-08-14)</h4> <h5>Chores</h5> <ul> <li>upgrade to typescript 7 (<a href="https://redirect.github.com/aws/aws-sdk-js-v3/pull/8264">#8264</a>) (<a href="https://github.com/aws/aws-sdk-js-v3/commit/ca81fbb7398345aa31482dd7aa1971bccf278989">ca81fbb7</a>)</li> <li>remove jest, use vitest for remaining test suites (<a href="https://redirect.github.com/aws/aws-sdk-js-v3/pull/8263">#8263</a>) (<a href="https://github.com/aws/aws-sdk-js-v3/commit/3a88aada579866331fe642d4b8147ede799deafa">3a88aada</a>)</li> </ul> <h5>Documentation Changes</h5> <ul> <li><strong>client-redshift:</strong> Amazon Redshift now unlocks a locked admin user account and resets the failed-login counter when you update the admin password using the ModifyCluster API. This option is available only when account lockout security is enabled. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/b93cb20c99c76c43369ffe2fb633577971c93236">b93cb20c</a>)</li> <li><strong>client-redshift-serverless:</strong> Amazon Redshift now unlocks a locked admin user account and resets the failed-login counter when you update the admin password using the UpdateNamespace API. This option is available only when account lockout security is enabled. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/197b4aa6163ac76eef6c7dce29b922fafdab395d">197b4aa6</a>)</li> </ul> <h5>New Features</h5> <ul> <li><strong>clients:</strong> update client endpoints as of 2026-08-14 (<a href="https://github.com/aws/aws-sdk-js-v3/commit/1e7a28061dde539727980cb25689db3c50d1507e">1e7a2806</a>)</li> <li><strong>client-bedrock-agentcore-control:</strong> Adds AgentCore Payments support for CMK, Marketplace Subscriptions and QuickCreate (<a href="https://github.com/aws/aws-sdk-js-v3/commit/39108eb0d601bb5916971f56dc8573ec17842cf8">39108eb0</a>)</li> <li><strong>client-sagemaker:</strong> Release support for g7.2xlarge, g7.4xlarge, g7.8xlarge, g7.12xlarge, g7.24xlarge, and g7.48xlarge instance types for SageMaker HyperPod (<a href="https://github.com/aws/aws-sdk-js-v3/commit/7198c1938d7897dc4f3839b04d8a55dba0f75c4b">7198c193</a>)</li> <li><strong>client-mwaa-serverless:</strong> Adds support for Consuming code for MWAA Serverless (<a href="https://github.com/aws/aws-sdk-js-v3/commit/e3edae27ddc8bcaf3e30f5ec93abdae0e013fae2">e3edae27</a>)</li> <li><strong>client-bedrock-agent-runtime:</strong> Adds CheckIngestedDocumentAcl and GetIngestedDocumentAcl APIs to Amazon Bedrock Knowledge Bases. Customers can verify user access to documents based on ingested ACLs and retrieve full ACL details including allow and deny entries, enabling validation of ACL ingestion without test retrievals. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/e86c42049cc69793f80c332bd9829ba6871153ad">e86c4204</a>)</li> <li><strong>client-observabilityadmin:</strong> CloudWatch Logs centralization rules now support tag propagation. You can configure a TagPropagationConfiguration on your centralization rule to automatically sync resource tags from source to destination log groups, with configurable conflict resolution strategies. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/c57d7a4cd3b279d750cc035e8861f1b2c8857da7">c57d7a4c</a>)</li> <li><strong>client-bedrock-agentcore:</strong> Add support for the Machine Payments Protocol (MPP) and x402 upto scheme payments protocol in Amazon Bedrock AgentCore Payments. Customers can now pay for MPP-gated resources and also pay services which requires upto scheme in x402 (<a href="https://github.com/aws/aws-sdk-js-v3/commit/7fdf457a8a7ff25eb019ef61c074158a3630816a">7fdf457a</a>)</li> <li><strong>client-glue:</strong> Added support for associating glossary terms with iterable form items, such as table columns. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/4c2e27d138f73f804774572c7772bcfd6a44006c">4c2e27d1</a>)</li> </ul> <hr /> <p>For list of updated packages, view <strong>updated-packages.md</strong> in <strong>assets-3.1111.0.zip</strong></p> <h2>v3.1110.0</h2> <h4>3.1110.0(2026-08-13)</h4> <h5>New Features</h5> <ul> <li><strong>client-auto-scaling:</strong> Amazon EC2 Auto Scaling now supports terminating multiple instances in a single TerminateInstanceInAutoScalingGroup call via the new InstanceIds parameter, returning an Activities list. LaunchInstances now returns IdempotentCallInProgressFault for duplicate client tokens. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/ee707980d238c2b5028e03084914a3398ce92709">ee707980</a>)</li> <li><strong>client-cleanrooms:</strong> This release adds support for minimum aggregation thresholds and comparison controls to the Custom analysis rule type. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/1f84f2ae77a1cf4aed0b61dafba5da358894d61f">1f84f2ae</a>)</li> <li><strong>client-codecommit:</strong> Added the GetBlobDifferences API operation, which returns line-level diffs between two blob versions without requiring a local clone. Returns structured hunks with context, additions, and deletions. Supports pagination for large diffs. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/f1165c620804c3e7e1b035ecb9e083c723b8fba3">f1165c62</a>)</li> <li><strong>client-securityagent:</strong> Add support for setting a maximum task-hour budget cap on penetration tests and code reviews, and for revalidating previously reported findings via a new REVALIDATION job type. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/aba75d728bf5a19eebc7afa1c78df8f18d9ae8d0">aba75d72</a>)</li> <li><strong>client-connect:</strong> Adds the StartAssistantContact API to start chat contacts handled by an AI agent. Adds SegmentAttributes to StartWebRTCContact, and corrects its error response to now receive AccessDeniedException (previously returned as an internal server error due to a missing error declaration). (<a href="https://github.com/aws/aws-sdk-js-v3/commit/67f9b7bb9bed253cc03580527faf7a94a2ebb2bf">67f9b7bb</a>)</li> <li><strong>client-acm:</strong> This change allows customers to update their existing email-validated certificates to use the DNS validation method. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/71c194a4678abd7a368925a38c5b63f411fbd483">71c194a4</a>)</li> </ul> <hr /> <p>For list of updated packages, view <strong>updated-packages.md</strong> in <strong>assets-3.1110.0.zip</strong></p> <h2>v3.1109.0</h2> <h4>3.1109.0(2026-08-12)</h4> <h5>Documentation Changes</h5> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md">@aws-sdk/client-s3's changelog</a>.</em></p> <blockquote> <h1><a href="https://github.com/aws/aws-sdk-js-v3/compare/v3.1110.0...v3.1111.0">3.1111.0</a> (2026-08-14)</h1> <p><strong>Note:</strong> Version bump only for package <code>@aws-sdk/client-s3</code></p> <h1><a href="https://github.com/aws/aws-sdk-js-v3/compare/v3.1109.0...v3.1110.0">3.1110.0</a> (2026-08-13)</h1> <p><strong>Note:</strong> Version bump only for package <code>@aws-sdk/client-s3</code></p> <h1><a href="https://github.com/aws/aws-sdk-js-v3/compare/v3.1108.0...v3.1109.0">3.1109.0</a> (2026-08-12)</h1> <p><strong>Note:</strong> Version bump only for package <code>@aws-sdk/client-s3</code></p> <h1><a href="https://github.com/aws/aws-sdk-js-v3/compare/v3.1107.0...v3.1108.0">3.1108.0</a> (2026-08-11)</h1> <p><strong>Note:</strong> Version bump only for package <code>@aws-sdk/client-s3</code></p> <h1><a href="https://github.com/aws/aws-sdk-js-v3/compare/v3.1106.0...v3.1107.0">3.1107.0</a> (2026-08-10)</h1> <p><strong>Note:</strong> Version bump only for package <code>@aws-sdk/client-s3</code></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/aws/aws-sdk-js-v3/commit/c41e9a98d4227b06099fdc7ea42bcf6fc5a1029f"><code>c41e9a9</code></a> Publish v3.1111.0</li> <li><a href="https://github.com/aws/aws-sdk-js-v3/commit/ca81fbb7398345aa31482dd7aa1971bccf278989"><code>ca81fbb</code></a> chore: upgrade to typescript 7 (<a href="https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3/issues/8264">#8264</a>)</li> <li><a href="https://github.com/aws/aws-sdk-js-v3/commit/4efe5bc67b71dc5ec652fe77130f3bae9efe0173"><code>4efe5bc</code></a> Publish v3.1110.0</li> <li><a href="https://github.com/aws/aws-sdk-js-v3/commit/d2ee371d0cc488521fbb8a2304f941a4a0b53d1a"><code>d2ee371</code></a> Publish v3.1109.0</li> <li><a href="https://github.com/aws/aws-sdk-js-v3/commit/26b0eb790ff86399b7af7b74ce8c188f25512cc6"><code>26b0eb7</code></a> Publish v3.1108.0</li> <li><a href="https://github.com/aws/aws-sdk-js-v3/commit/785d467fbde2fe2f3720bbb944caefcb198039ed"><code>785d467</code></a> chore(codegen): update smithy-ts commit to bring in TS6 change (<a href="https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3/issues/8262">#8262</a>)</li> <li><a href="https://github.com/aws/aws-sdk-js-v3/commit/edabd4a5228e259e9f3352cd47414069db755188"><code>edabd4a</code></a> chore: upgrade to typescript 6 (<a href="https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3/issues/8257">#8257</a>)</li> <li><a href="https://github.com/aws/aws-sdk-js-v3/commit/d87c82ba2021a598a478383ae50647e7c1af45e0"><code>d87c82b</code></a> Publish v3.1107.0</li> <li><a href="https://github.com/aws/aws-sdk-js-v3/commit/2e4482a67896a98b3fc23933c5cf2ad7c1d61f10"><code>2e4482a</code></a> chore(codegen): smithy-aws-typescript-codegen 0.52.0 (<a href="https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3/issues/8255">#8255</a>)</li> <li>See full diff in <a href="https://github.com/aws/aws-sdk-js-v3/commits/v3.1111.0/clients/client-s3">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
98298cb7ff |
build(deps-dev): bump tsx from 4.23.1 to 4.23.12 (#11722)
Bumps [tsx](https://github.com/privatenumber/tsx) from 4.23.1 to 4.23.12. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/privatenumber/tsx/releases">tsx's releases</a>.</em></p> <blockquote> <h2>v4.23.12</h2> <h2><a href="https://github.com/privatenumber/tsx/compare/v4.23.11...v4.23.12">4.23.12</a> (2026-08-10)</h2> <h3>Bug Fixes</h3> <ul> <li>shim <code>import.meta</code> when tokens are split by comments or newlines (<a href="https://redirect.github.com/privatenumber/tsx/issues/829">#829</a>) (<a href="https://github.com/privatenumber/tsx/commit/ed9d33046a135de13a35fdfce12368b79d1b1518">ed9d330</a>), closes <a href="https://redirect.github.com/privatenumber/tsx/issues/828">#828</a></li> </ul> <hr /> <p>This release is also available on:</p> <ul> <li><a href="https://www.npmjs.com/package/tsx/v/4.23.12"><code>npm package (@latest dist-tag)</code></a></li> </ul> <h2>v4.23.11</h2> <h2><a href="https://github.com/privatenumber/tsx/compare/v4.23.10...v4.23.11">4.23.11</a> (2026-08-07)</h2> <h3>Bug Fixes</h3> <ul> <li>preserve async ESM require fallback (<a href="https://github.com/privatenumber/tsx/commit/55cbecef8ebe839c7110e8c141a1c3bc4da326cd">55cbece</a>)</li> </ul> <hr /> <p>This release is also available on:</p> <ul> <li><a href="https://www.npmjs.com/package/tsx/v/4.23.11"><code>npm package (@latest dist-tag)</code></a></li> </ul> <h2>v4.23.10</h2> <h2><a href="https://github.com/privatenumber/tsx/compare/v4.23.9...v4.23.10">4.23.10</a> (2026-08-07)</h2> <h3>Bug Fixes</h3> <ul> <li>support nyc coverage discovery (<a href="https://redirect.github.com/privatenumber/tsx/issues/710">#710</a>) (<a href="https://github.com/privatenumber/tsx/commit/ec1bcd5f711e5159b67cb0aea211f06cf2cfce8a">ec1bcd5</a>)</li> </ul> <hr /> <p>This release is also available on:</p> <ul> <li><a href="https://www.npmjs.com/package/tsx/v/4.23.10"><code>npm package (@latest dist-tag)</code></a></li> </ul> <h2>v4.23.9</h2> <h2><a href="https://github.com/privatenumber/tsx/compare/v4.23.8...v4.23.9">4.23.9</a> (2026-08-06)</h2> <h3>Bug Fixes</h3> <ul> <li>map Node test locations (<a href="https://github.com/privatenumber/tsx/commit/2f55884195a8c745fbe64a0288de69bc062ed876">2f55884</a>)</li> <li>support data URLs in tsImport (<a href="https://github.com/privatenumber/tsx/commit/b94f46f6b6a7e6dc575624b0ecc7124318723056">b94f46f</a>)</li> </ul> <hr /> <p>This release is also available on:</p> <ul> <li><a href="https://www.npmjs.com/package/tsx/v/4.23.9"><code>npm package (@latest dist-tag)</code></a></li> </ul> <h2>v4.23.8</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/privatenumber/tsx/commit/ed9d33046a135de13a35fdfce12368b79d1b1518"><code>ed9d330</code></a> fix: shim <code>import.meta</code> when tokens are split by comments or newlines (<a href="https://redirect.github.com/privatenumber/tsx/issues/829">#829</a>)</li> <li><a href="https://github.com/privatenumber/tsx/commit/651f5bec70d9a116d1fe1706000b7ca011a516fc"><code>651f5be</code></a> test: cover CommonJS TypeScript import.meta paths</li> <li><a href="https://github.com/privatenumber/tsx/commit/bd3bc6448e957c1172eb91a0584ec7fec2d6a7ad"><code>bd3bc64</code></a> test: cover CommonJS loader source fallback</li> <li><a href="https://github.com/privatenumber/tsx/commit/55cbecef8ebe839c7110e8c141a1c3bc4da326cd"><code>55cbece</code></a> fix: preserve async ESM require fallback</li> <li><a href="https://github.com/privatenumber/tsx/commit/6c5ba85f7a1e57f06bcb760718d6ba3b978e5a05"><code>6c5ba85</code></a> docs: document CommonJS default interop</li> <li><a href="https://github.com/privatenumber/tsx/commit/ec1bcd5f711e5159b67cb0aea211f06cf2cfce8a"><code>ec1bcd5</code></a> fix: support nyc coverage discovery (<a href="https://redirect.github.com/privatenumber/tsx/issues/710">#710</a>)</li> <li><a href="https://github.com/privatenumber/tsx/commit/b6e5b48a7b0fa4639e67119c8b02150ec8c6cef7"><code>b6e5b48</code></a> docs: clarify CommonJS default imports</li> <li><a href="https://github.com/privatenumber/tsx/commit/2f55884195a8c745fbe64a0288de69bc062ed876"><code>2f55884</code></a> fix: map Node test locations</li> <li><a href="https://github.com/privatenumber/tsx/commit/de935d588b6c0959ac8af71e2cf40d1a61e659e7"><code>de935d5</code></a> docs: document Node source-map stack formatting</li> <li><a href="https://github.com/privatenumber/tsx/commit/b94f46f6b6a7e6dc575624b0ecc7124318723056"><code>b94f46f</code></a> fix: support data URLs in tsImport</li> <li>Additional commits viewable in <a href="https://github.com/privatenumber/tsx/compare/v4.23.1...v4.23.12">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
ec8d7dd21f |
build(deps): bump ws from 8.21.1 to 8.21.3 (#11729)
Bumps [ws](https://github.com/websockets/ws) from 8.21.1 to 8.21.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/websockets/ws/releases">ws's releases</a>.</em></p> <blockquote> <h2>8.21.3</h2> <h1>Bug fixes</h1> <ul> <li>The server now correctly rejects permessage-deflate offers if the incoming <code>client_max_window_bits</code> parameter value is smaller than its configured <code>clientMaxWindowBits</code> (e97a20ea).</li> </ul> <h2>8.21.2</h2> <h1>Bug fixes</h1> <ul> <li>Fixed a test for <a href="https://github.com/nodejs/citgm">CITGM</a> (2eb3be0b).</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/websockets/ws/commit/c791e707eab3c13dd9a261d2479c3cc4a49a6fed"><code>c791e70</code></a> [dist] 8.21.3</li> <li><a href="https://github.com/websockets/ws/commit/e97a20eaa6f2ad7969419eed732a506453251eb9"><code>e97a20e</code></a> [fix] Reject offers with <code>client_max_window_bits</code> below config</li> <li><a href="https://github.com/websockets/ws/commit/787ebf22ce3d091fb6f931d20b4c7e914ba7cf85"><code>787ebf2</code></a> [dist] 8.21.2</li> <li><a href="https://github.com/websockets/ws/commit/b4d62ebad40c3b925c84ff305a47975406015422"><code>b4d62eb</code></a> Revert "[ci] Trust Coveralls Homebrew tap"</li> <li><a href="https://github.com/websockets/ws/commit/e4bb883723a0c18452eea10a74139901ae33c61d"><code>e4bb883</code></a> [security] Use GitHub PVR as main reporting channel</li> <li><a href="https://github.com/websockets/ws/commit/2eb3be0bff2453e2654b1315c5872e8d5d424a50"><code>2eb3be0</code></a> [test] Skip test on Node.js versions where it does not apply</li> <li>See full diff in <a href="https://github.com/websockets/ws/compare/8.21.1...8.21.3">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
f27c0ee3f9 |
build(deps): bump open from 11.0.0 to 11.0.1 (#11517)
Bumps [open](https://github.com/sindresorhus/open) from 11.0.0 to 11.0.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sindresorhus/open/releases">open's releases</a>.</em></p> <blockquote> <h2>v11.0.1</h2> <ul> <li>Fix WSL failure when the working directory is unreachable from Windows 6ac3fe4</li> </ul> <hr /> <p><a href="https://github.com/sindresorhus/open/compare/v11.0.0...v11.0.1">https://github.com/sindresorhus/open/compare/v11.0.0...v11.0.1</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sindresorhus/open/commit/f38acc807a8760968310759a203cf14ca4d54727"><code>f38acc8</code></a> 11.0.1</li> <li><a href="https://github.com/sindresorhus/open/commit/6ac3fe443994a3a2a61ee6785b9169faf96115c3"><code>6ac3fe4</code></a> Fix WSL failure when the working directory is unreachable from Windows</li> <li><a href="https://github.com/sindresorhus/open/commit/a30acc78bef1c1e5448bd88d19180e8ad6899ab9"><code>a30acc7</code></a> Meta tweaks</li> <li>See full diff in <a href="https://github.com/sindresorhus/open/compare/v11.0.0...v11.0.1">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
6aaef2998f |
build(deps): bump better-auth from 1.6.25 to 1.6.28 (#11516)
Bumps [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) from 1.6.25 to 1.6.28. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/better-auth/better-auth/releases">better-auth's releases</a>.</em></p> <blockquote> <h2>v1.6.28</h2> <h2><code>better-auth</code></h2> <h3>Bug Fixes</h3> <ul> <li>Prevented duplicate session requests during React Suspense retries while preserving revalidation for interrupted refreshes (<a href="https://redirect.github.com/better-auth/better-auth/pull/10769">#10769</a>)</li> <li>Restored client plugin declaration compatibility for downstream TypeScript consumers (<a href="https://redirect.github.com/better-auth/better-auth/pull/10794">#10794</a>)</li> </ul> <p>For detailed changes, see the <a href="https://github.com/better-auth/better-auth/blob/86faaee69b6c2afe237fff8a00602ecc8eccc367/packages/better-auth/CHANGELOG.md"><code>CHANGELOG</code></a>.</p> <h2><code>@better-auth/electron</code></h2> <h3>Bug Fixes</h3> <ul> <li>Restored client plugin declaration compatibility for downstream TypeScript consumers (<a href="https://redirect.github.com/better-auth/better-auth/pull/10794">#10794</a>)</li> </ul> <p>For detailed changes, see the <a href="https://github.com/better-auth/better-auth/blob/86faaee69b6c2afe237fff8a00602ecc8eccc367/packages/electron/CHANGELOG.md"><code>CHANGELOG</code></a>.</p> <h2><code>@better-auth/expo</code></h2> <h3>Bug Fixes</h3> <ul> <li>Restored client plugin declaration compatibility for downstream TypeScript consumers (<a href="https://redirect.github.com/better-auth/better-auth/pull/10794">#10794</a>)</li> </ul> <p>For detailed changes, see the <a href="https://github.com/better-auth/better-auth/blob/86faaee69b6c2afe237fff8a00602ecc8eccc367/packages/expo/CHANGELOG.md"><code>CHANGELOG</code></a>.</p> <h2>Contributors</h2> <p>Thanks to everyone who contributed to this release:</p> <p><a href="https://github.com/bytaesu"><code>@bytaesu</code></a></p> <p><strong>Full changelog:</strong> <a href="https://github.com/better-auth/better-auth/compare/v1.6.27...v1.6.28"><code>v1.6.27...v1.6.28</code></a></p> <h2>v1.6.27</h2> <h2><code>better-auth</code></h2> <h3>Bug Fixes</h3> <ul> <li>Fixed duplicate session requests being made across Suspense retries (<a href="https://redirect.github.com/better-auth/better-auth/pull/10676">#10676</a>)</li> </ul> <p>For detailed changes, see <a href="https://github.com/better-auth/better-auth/blob/be47e9418b4a25a4ecd51ba781d2296373b65a03/packages/better-auth/CHANGELOG.md"><code>CHANGELOG</code></a></p> <h2><code>@better-auth/scim</code></h2> <h3>Bug Fixes</h3> <ul> <li>Fixed auth endpoint types to align with <code>better-call</code> (<a href="https://redirect.github.com/better-auth/better-auth/pull/10657">#10657</a>)</li> </ul> <p>For detailed changes, see <a href="https://github.com/better-auth/better-auth/blob/be47e9418b4a25a4ecd51ba781d2296373b65a03/packages/scim/CHANGELOG.md"><code>CHANGELOG</code></a></p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md">better-auth's changelog</a>.</em></p> <blockquote> <h2>1.6.28</h2> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/10769">#10769</a> <a href="https://github.com/better-auth/better-auth/commit/773de54b18c0e920a3542bdecaf8b42fffc0dc4b"><code>773de54</code></a> Thanks <a href="https://github.com/bytaesu"><code>@bytaesu</code></a>! - Prevent duplicate session requests during transient remounts while ensuring incomplete refreshes are revalidated.</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/10794">#10794</a> <a href="https://github.com/better-auth/better-auth/commit/2ad2928f967afa9f9858caecd01466ecb8686982"><code>2ad2928</code></a> Thanks <a href="https://github.com/bytaesu"><code>@bytaesu</code></a>! - Restore client plugin declaration compatibility for downstream TypeScript consumers.</p> </li> <li> <p>Updated dependencies []:</p> <ul> <li><code>@better-auth/core</code><a href="https://github.com/1"><code>@1</code></a>.6.28</li> <li><code>@better-auth/drizzle-adapter</code><a href="https://github.com/1"><code>@1</code></a>.6.28</li> <li><code>@better-auth/kysely-adapter</code><a href="https://github.com/1"><code>@1</code></a>.6.28</li> <li><code>@better-auth/memory-adapter</code><a href="https://github.com/1"><code>@1</code></a>.6.28</li> <li><code>@better-auth/mongo-adapter</code><a href="https://github.com/1"><code>@1</code></a>.6.28</li> <li><code>@better-auth/prisma-adapter</code><a href="https://github.com/1"><code>@1</code></a>.6.28</li> <li><code>@better-auth/telemetry</code><a href="https://github.com/1"><code>@1</code></a>.6.28</li> </ul> </li> </ul> <h2>1.6.27</h2> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/10657">#10657</a> <a href="https://github.com/better-auth/better-auth/commit/2ae491eac3ece50839a0eb2d4f868c4deedac67b"><code>2ae491e</code></a> Thanks <a href="https://github.com/bytaesu"><code>@bytaesu</code></a>! - Aligned endpoint and middleware context types with runtime route parameters, and preserved response headers when resolving sessions from endpoint contexts.</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/10676">#10676</a> <a href="https://github.com/better-auth/better-auth/commit/90b509344794b8064700371cbc04b985d0519839"><code>90b5093</code></a> Thanks <a href="https://github.com/bytaesu"><code>@bytaesu</code></a>! - Deduplicate in-flight session requests when React retries a suspended component.</p> </li> <li> <p>Updated dependencies [<a href="https://github.com/better-auth/better-auth/commit/2ae491eac3ece50839a0eb2d4f868c4deedac67b"><code>2ae491e</code></a>]:</p> <ul> <li><code>@better-auth/core</code><a href="https://github.com/1"><code>@1</code></a>.6.27</li> <li><code>@better-auth/drizzle-adapter</code><a href="https://github.com/1"><code>@1</code></a>.6.27</li> <li><code>@better-auth/kysely-adapter</code><a href="https://github.com/1"><code>@1</code></a>.6.27</li> <li><code>@better-auth/memory-adapter</code><a href="https://github.com/1"><code>@1</code></a>.6.27</li> <li><code>@better-auth/mongo-adapter</code><a href="https://github.com/1"><code>@1</code></a>.6.27</li> <li><code>@better-auth/prisma-adapter</code><a href="https://github.com/1"><code>@1</code></a>.6.27</li> <li><code>@better-auth/telemetry</code><a href="https://github.com/1"><code>@1</code></a>.6.27</li> </ul> </li> </ul> <h2>1.6.26</h2> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/10619">#10619</a> <a href="https://github.com/better-auth/better-auth/commit/9ede8059b56e1415c1e8cfdd93ff72691b848bbf"><code>9ede805</code></a> Thanks <a href="https://github.com/jeroenvandermerwe"><code>@jeroenvandermerwe</code></a>! - Ensure database rate-limit cleanup completes when no background task handler is configured.</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/10608">#10608</a> <a href="https://github.com/better-auth/better-auth/commit/5a811f1b4314b8bcf6f21c0b72de5cb67d552d97"><code>5a811f1</code></a> Thanks <a href="https://github.com/bytaesu"><code>@bytaesu</code></a>! - Pass the email verification type to custom OTP generators after email sign-up.</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/10605">#10605</a> <a href="https://github.com/better-auth/better-auth/commit/d8327f1fea92243b6fea1b0ab183e2a989792c0c"><code>d8327f1</code></a> Thanks <a href="https://github.com/XXMOHAMED012"><code>@XXMOHAMED012</code></a>! - The email OTP verification check no longer reveals whether an email is registered before the OTP itself is verified.</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/10513">#10513</a> <a href="https://github.com/better-auth/better-auth/commit/e2c73fbec87f5e19f6a2b5ac371bc5bba9bd49ff"><code>e2c73fb</code></a> Thanks <a href="https://github.com/mrosberghaus"><code>@mrosberghaus</code></a>! - Fix <code>jwtClient()</code> collapsing <code>createAuthClient</code> type inference when combined with other client plugins such as <code>inferAdditionalFields</code>. Additional user fields (for example on <code>updateUser</code>) are preserved again.</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/10635">#10635</a> <a href="https://github.com/better-auth/better-auth/commit/af50c45553a62cfb6cdcdede86828731ca00c22c"><code>af50c45</code></a> Thanks <a href="https://github.com/krish-vachhani"><code>@krish-vachhani</code></a>! - Fix <code>oneTapClient()</code> collapsing <code>createAuthClient</code> type inference when combined with other client plugins. The <code>oneTap</code> action is available on the client again.</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/10633">#10633</a> <a href="https://github.com/better-auth/better-auth/commit/701cd43babac52784d855291a6adc0cf3fba7970"><code>701cd43</code></a> Thanks <a href="https://github.com/gustavovalverde"><code>@gustavovalverde</code></a>! - Minting or reading a JWKS signing key inside an active database transaction now uses the transaction-scoped adapter instead of the root connection. On a single-connection SQLite database with native transactions enabled, this no longer deadlocks, and on Postgres and MySQL the key commits with the surrounding transaction instead of independently of it.</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/better-auth/better-auth/commit/86faaee69b6c2afe237fff8a00602ecc8eccc367"><code>86faaee</code></a> chore: release v1.6.28 (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10796">#10796</a>)</li> <li><a href="https://github.com/better-auth/better-auth/commit/773de54b18c0e920a3542bdecaf8b42fffc0dc4b"><code>773de54</code></a> fix(client): deduplicate settled session requests during Suspense retries (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/1">#1</a>...</li> <li><a href="https://github.com/better-auth/better-auth/commit/c92a1ca27bb3f430811f007e6b7769ac31c9749a"><code>c92a1ca</code></a> chore: upgrade <code>next</code> to 16.3 (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10787">#10787</a>)</li> <li><a href="https://github.com/better-auth/better-auth/commit/be47e9418b4a25a4ecd51ba781d2296373b65a03"><code>be47e94</code></a> chore: release v1.6.27 (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10686">#10686</a>)</li> <li><a href="https://github.com/better-auth/better-auth/commit/2ae491eac3ece50839a0eb2d4f868c4deedac67b"><code>2ae491e</code></a> fix(types): align auth endpoints with <code>better-call</code> (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10657">#10657</a>)</li> <li><a href="https://github.com/better-auth/better-auth/commit/90b509344794b8064700371cbc04b985d0519839"><code>90b5093</code></a> fix(client): deduplicate session requests across suspense retries (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10676">#10676</a>)</li> <li><a href="https://github.com/better-auth/better-auth/commit/a16b30e8437927c08350194000178073b06af8cf"><code>a16b30e</code></a> chore: release v1.6.26 (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10521">#10521</a>)</li> <li><a href="https://github.com/better-auth/better-auth/commit/9ede8059b56e1415c1e8cfdd93ff72691b848bbf"><code>9ede805</code></a> fix(rate-limit): await database cleanup by default (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10619">#10619</a>)</li> <li><a href="https://github.com/better-auth/better-auth/commit/af50c45553a62cfb6cdcdede86828731ca00c22c"><code>af50c45</code></a> fix(one-tap): preserve client plugin inference with oneTapClient (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10635">#10635</a>)</li> <li><a href="https://github.com/better-auth/better-auth/commit/222facff556e6c570bbd6b7fd5923757b5a55711"><code>222facf</code></a> fix(jwt): resolve the transaction-scoped adapter when signing (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10623">#10623</a>)</li> <li>Additional commits viewable in <a href="https://github.com/better-auth/better-auth/commits/v1.6.28/packages/better-auth">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
403fcefb97 |
build(deps-dev): bump vite from 6.4.1 to 6.4.3 (#11317)
Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) from 6.4.1 to 6.4.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vitejs/vite/releases">vite's releases</a>.</em></p> <blockquote> <h2>v6.4.3</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v6.4.3/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v6.4.2</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v6.4.2/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/vitejs/vite/blob/v6.4.3/packages/vite/CHANGELOG.md">vite's changelog</a>.</em></p> <blockquote> <h2><!-- raw HTML omitted -->6.4.3 (2026-06-01)<!-- raw HTML omitted --></h2> <ul> <li>fix: backport <a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22572">#22572</a>, reject windows alternate paths (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22576">#22576</a>) (<a href="https://github.com/vitejs/vite/commit/96b0c10162e9c55485d922db2cfc6b8227cbc176">96b0c10</a>), closes <a href="https://redirect.github.com/vitejs/vite/issues/22572">#22572</a> <a href="https://redirect.github.com/vitejs/vite/issues/22576">#22576</a></li> <li>fix(deps): backport <a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22571">#22571</a>, reject UNC paths for launch-editor-middleware (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22575">#22575</a>) (<a href="https://github.com/vitejs/vite/commit/8fed5cf540c0d475266787f52072f258478cd42f">8fed5cf</a>), closes <a href="https://redirect.github.com/vitejs/vite/issues/22571">#22571</a> <a href="https://redirect.github.com/vitejs/vite/issues/22575">#22575</a></li> </ul> <h2><!-- raw HTML omitted -->6.4.2 (2026-04-06)<!-- raw HTML omitted --></h2> <ul> <li>fix: apply server.fs check to env transport (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22159">#22159</a>) (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22163">#22163</a>) (<a href="https://github.com/vitejs/vite/commit/fe28e47e9463e4c9619f94bfa06d2f8f1411b44b">fe28e47</a>), closes <a href="https://redirect.github.com/vitejs/vite/issues/22159">#22159</a> <a href="https://redirect.github.com/vitejs/vite/issues/22163">#22163</a></li> <li>fix: avoid path traversal with optimize deps sourcemap handler (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22161">#22161</a>) (<a href="https://github.com/vitejs/vite/commit/ca4da5d1fb45c9cfdce606aa30825095791b164b">ca4da5d</a>), closes <a href="https://redirect.github.com/vitejs/vite/issues/22161">#22161</a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vitejs/vite/commit/6c2c881f15495738ff03bc1d67cc052c07e0cac4"><code>6c2c881</code></a> release: v6.4.3</li> <li><a href="https://github.com/vitejs/vite/commit/96b0c10162e9c55485d922db2cfc6b8227cbc176"><code>96b0c10</code></a> fix: backport <a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22572">#22572</a>, reject windows alternate paths (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22576">#22576</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/8fed5cf540c0d475266787f52072f258478cd42f"><code>8fed5cf</code></a> fix(deps): backport <a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22571">#22571</a>, reject UNC paths for launch-editor-middleware (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/2">#2</a>...</li> <li><a href="https://github.com/vitejs/vite/commit/6b3fad02abd550bd7b79934ff92c58dbd7f33045"><code>6b3fad0</code></a> release: v6.4.2</li> <li><a href="https://github.com/vitejs/vite/commit/ca4da5d1fb45c9cfdce606aa30825095791b164b"><code>ca4da5d</code></a> fix: avoid path traversal with optimize deps sourcemap handler (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22161">#22161</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/fe28e47e9463e4c9619f94bfa06d2f8f1411b44b"><code>fe28e47</code></a> fix: apply server.fs check to env transport (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22159">#22159</a>) (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22163">#22163</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/5487f4f641f70c47ea05fd101a4319897df048b3"><code>5487f4f</code></a> release: v6.4.1</li> <li><a href="https://github.com/vitejs/vite/commit/1114b5d7ea03e26572708715343bec69db4536e8"><code>1114b5d</code></a> fix(dev): trim trailing slash before <code>server.fs.deny</code> check (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/20968">#20968</a>) (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/20969">#20969</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/f12697c0f64b9a37196b9ab218a0911829d5b103"><code>f12697c</code></a> release: v6.4.0</li> <li><a href="https://github.com/vitejs/vite/commit/ca6455ee9eb6111a9caa9810506a1b9ac96a520a"><code>ca6455e</code></a> feat: allow passing down resolved config to vite's createServer (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/20932">#20932</a>)</li> <li>Additional commits viewable in <a href="https://github.com/vitejs/vite/commits/v6.4.3/packages/vite">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
88e1ccb424 |
build(deps): bump @aws-sdk/client-s3 from 3.1075.0 to 3.1106.0 (#11315)
Bumps [@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3) from 3.1075.0 to 3.1106.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/aws/aws-sdk-js-v3/releases">@aws-sdk/client-s3's releases</a>.</em></p> <blockquote> <h2>v3.1106.0</h2> <h4>3.1106.0(2026-08-07)</h4> <h5>New Features</h5> <ul> <li><strong>clients:</strong> update client endpoints as of 2026-08-07 (<a href="https://github.com/aws/aws-sdk-js-v3/commit/c5d05426d83dccbcee03b0b0c024ba255bea4418">c5d05426</a>)</li> <li><strong>client-amplify:</strong> Increased the maximum allowed length of the oauthToken parameter in the CreateApp and UpdateApp APIs to support longer OAuth tokens issued by third-party Git providers. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/b239e29295315bacf5d76a343e6d5aa397987642">b239e292</a>)</li> <li><strong>client-healthlake:</strong> Adds provenanceEnabled to StartFHIRImportJob (<a href="https://github.com/aws/aws-sdk-js-v3/commit/18ac6efeb92731ee5b0a8d616e05766a2dd33dbf">18ac6efe</a>)</li> <li><strong>client-securityagent:</strong> Added enableEmailMfa input field on Actor to enable email-based MFA during penetration tests. When enabled, a server-generated mfaForwardingAddress is returned. Set up a forwarding rule in your email provider to forward MFA emails to this address so the agent can complete email-based MFA login flows (<a href="https://github.com/aws/aws-sdk-js-v3/commit/e21d39190ef400777abbaf689a61c6b231f333e0">e21d3919</a>)</li> <li><strong>client-mediapackagev2:</strong> StreamNameOutputMode - a new optional field on MediaPackageV2 OriginEndpoints that lets customers choose whether egress manifests use numeric stream indices (default) or encoder-assigned stream names from the input (<a href="https://github.com/aws/aws-sdk-js-v3/commit/7f49cb060702dc502b6b5733a18eee753a84005e">7f49cb06</a>)</li> <li><strong>client-sagemaker:</strong> Amazon SageMaker adds maintenance lifecycle statuses for Notebook Instances (<a href="https://github.com/aws/aws-sdk-js-v3/commit/6ce0f8843a4d69e0426e53dae61a194c8e576d76">6ce0f884</a>)</li> <li><strong>client-ec2:</strong> This release adds support for BGP route protection in Amazon VPC IP Address Manager (IPAM), including route discovery, RPKI route protection findings, and delegated RPKI (Internet Registry Associations, routing policy registrations, and ROA management) for BYOIP prefixes. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/62f281df5a1d7476485851907d2331f35c480d8e">62f281df</a>)</li> <li><strong>client-mediatailor:</strong> Added support for inserting ads via the VAST Ad Buffet standard. You can now configure MediaTailor to insert ads in sequence order using the AdSequencingMode setting in your playback configuration. Standalone ads are used as fallbacks when a sequenced ad is unavailable. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/7bebb1e56db3c40906a554b824640848c6f1539e">7bebb1e5</a>)</li> <li><strong>client-connect:</strong> Supports updating the task template associated with in-progress task contacts using the new UpdateContactTaskTemplate API. This enables supervisors and developers to dynamically reassign task templates without creating a new task. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/24f404168125e330e402673b14003258403979c7">24f40416</a>)</li> </ul> <hr /> <p>For list of updated packages, view <strong>updated-packages.md</strong> in <strong>assets-3.1106.0.zip</strong></p> <h2>v3.1105.0</h2> <h4>3.1105.0(2026-08-06)</h4> <h5>Chores</h5> <ul> <li><strong>lib-dynamodb:</strong> add error msg and fallback when incompatible client is supplied (<a href="https://redirect.github.com/aws/aws-sdk-js-v3/pull/8231">#8231</a>) (<a href="https://github.com/aws/aws-sdk-js-v3/commit/e663d41f0c95fe461693ecc6599d8d48cb786d01">e663d41f</a>)</li> </ul> <h5>New Features</h5> <ul> <li><strong>clients:</strong> update client endpoints as of 2026-08-06 (<a href="https://github.com/aws/aws-sdk-js-v3/commit/e4f7b32fca9d7c72e76dad9be36dcc2b2665e965">e4f7b32f</a>)</li> <li><strong>client-cloudwatch-logs:</strong> This release adds index category support to the CloudWatch Logs DescribeFieldIndexes API. Customers can filter and identify DEFAULT, CUSTOM, AUTO, and INACTIVE field indexes. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/e17fff6fee91039894b4004860657b0eedeed439">e17fff6f</a>)</li> <li><strong>client-socialmessaging:</strong> Add support for WhatsApp Conversions APIs. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/5c29a869869738008410e38f2d353c12139a0344">5c29a869</a>)</li> <li><strong>client-gamelift:</strong> Adds support for C8a, C8i, C9g, M8a, M8i, and M9g EC2 instance type families for managed EC2 and container fleets. Also adds explicit anchors on most string regexes. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/30dfd63ab84fbcca27dc257af51e44359eb9c75d">30dfd63a</a>)</li> <li><strong>client-securityhub:</strong> Security Hub is adding a new public API, ListFreeTrialStatusesV2 to describe the free trial statuses of the Security Hub service and its opt-in features. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/e44b3582d5bb381c6ab6798c1718bc177d266011">e44b3582</a>)</li> <li><strong>client-bedrock-agentcore-control:</strong> Add support for Gateway rate limits and Runtime instances in Amazon Bedrock AgentCore. Customers can now configure rate limits scoped to control request rates, token consumption rates, and active connection rates. Customers can now create capacity providers to launch runtimes on their EC2 instances. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/865d21efa6b8b76fcf693655e3eb34d498027a00">865d21ef</a>)</li> <li><strong>client-device-farm:</strong> Adds support for service generated insights across runs, jobs, and tests. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/6c601b71011de09898e06a1a24f2a6cfc34b8a83">6c601b71</a>)</li> <li><strong>client-sagemaker:</strong> Releases new Model Customization SequenceLength parameter for Training and g7 instance types for Training and Processing. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/14bd2ac7dcd439796f379b9b44cd3f6ce9094984">14bd2ac7</a>)</li> <li><strong>client-agent-registry-control:</strong> Agent Registry's Public Preview release (<a href="https://github.com/aws/aws-sdk-js-v3/commit/a137863d854230093579807ab5f1d4edfedb2582">a137863d</a>)</li> <li><strong>client-backup:</strong> AWS Backup now lets you create read-only access points for Amazon S3 recovery points, enabling you to access backup data using S3 APIs without initiating a restore. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/636228a9535bd3992a69093e27dcdc5d376f8b61">636228a9</a>)</li> <li><strong>client-mediatailor:</strong> AWS Elemental MediaTailor now supports concurrent function execution. The new Concurrent Executor function type runs multiple independent child functions in parallel within a single lifecycle hook, reducing pipeline latency to the duration of the slowest call instead of the sum of all calls. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/1cf61475d4320afddf9610addf91742d0f8173c3">1cf61475</a>)</li> <li><strong>client-marketplace-agreement:</strong> GetAgreementTerms now returns a new term variant in AcceptedTerm, netPaymentTerm, with a paymentDuePeriod field (example "P30D"). (<a href="https://github.com/aws/aws-sdk-js-v3/commit/50b0d6d565c7f1ce784ab870ec6a89c4c859f3fb">50b0d6d5</a>)</li> <li><strong>client-agent-registry:</strong> Agent Registry's Public Preview release (<a href="https://github.com/aws/aws-sdk-js-v3/commit/632ae47917c818dc16fa4fba183a90d3a6a8b931">632ae479</a>)</li> <li><strong>client-kafka:</strong> MSK Clusters can now deliver authorizer logs alongside broker logs to the destinations defined by you (<a href="https://github.com/aws/aws-sdk-js-v3/commit/b7e319378345cbd88c558df301477edc98939855">b7e31937</a>)</li> <li><strong>client-bedrock-agentcore:</strong> Add support for capacity provider sessions in Amazon Bedrock AgentCore. Customers can now delete an active session running on a runtime instance launched through their capacity provider. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/bd301533b88ffe5eead68964c90cb82a76d4dc3b">bd301533</a>)</li> <li><strong>client-auto-scaling:</strong> EC2 Auto Scaling now supports being managed by other AWS services via the operator field. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/f5d54fce5f196113a276fa282da2ad0e1190838a">f5d54fce</a>)</li> <li><strong>client-ec2:</strong> Adds a new optional IncludeLocalZones parameter to the Spot Placement Score API that defaults to false. When set to true, the Spot Placement Score API will consider the relevant Local Zones with Spot capacity when computing the Spot Placement Score. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/43673842a0545caf2e6843c7d3e82349270f48df">43673842</a>)</li> <li><strong>client-marketplace-discovery:</strong> GetOfferTerms now returns netPaymentTerm in offerTerms, specifying payment due period after invoice date. The paymentDuePeriod field uses ISO 8601 duration format (e.g., "P30D" for net 30 days). This is a backward-compatible addition. See API documentation for full structure and examples. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/f4fd7ae7b8b872cb9f4e497470ea401a642683fd">f4fd7ae7</a>)</li> <li><strong>client-s3:</strong> AWS Backup now lets you create read-only access points for Amazon S3 recovery points, enabling you to access backup data using S3 APIs without initiating a restore. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/faf65602698bd9924362b5f1544b40f410cffb7d">faf65602</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md">@aws-sdk/client-s3's changelog</a>.</em></p> <blockquote> <h1><a href="https://github.com/aws/aws-sdk-js-v3/compare/v3.1105.0...v3.1106.0">3.1106.0</a> (2026-08-07)</h1> <p><strong>Note:</strong> Version bump only for package <code>@aws-sdk/client-s3</code></p> <h1><a href="https://github.com/aws/aws-sdk-js-v3/compare/v3.1104.0...v3.1105.0">3.1105.0</a> (2026-08-06)</h1> <h3>Features</h3> <ul> <li><strong>client-s3:</strong> AWS Backup now lets you create read-only access points for Amazon S3 recovery points, enabling you to access backup data using S3 APIs without initiating a restore. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/faf65602698bd9924362b5f1544b40f410cffb7d">faf6560</a>)</li> </ul> <h1><a href="https://github.com/aws/aws-sdk-js-v3/compare/v3.1103.0...v3.1104.0">3.1104.0</a> (2026-08-05)</h1> <p><strong>Note:</strong> Version bump only for package <code>@aws-sdk/client-s3</code></p> <h1><a href="https://github.com/aws/aws-sdk-js-v3/compare/v3.1102.0...v3.1103.0">3.1103.0</a> (2026-08-04)</h1> <p><strong>Note:</strong> Version bump only for package <code>@aws-sdk/client-s3</code></p> <h1><a href="https://github.com/aws/aws-sdk-js-v3/compare/v3.1101.0...v3.1102.0">3.1102.0</a> (2026-08-03)</h1> <p><strong>Note:</strong> Version bump only for package <code>@aws-sdk/client-s3</code></p> <h1><a href="https://github.com/aws/aws-sdk-js-v3/compare/v3.1100.0...v3.1101.0">3.1101.0</a> (2026-07-31)</h1> <p><strong>Note:</strong> Version bump only for package <code>@aws-sdk/client-s3</code></p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/aws/aws-sdk-js-v3/commit/655d311ea01bb7ca2bf15b1cd85003c6f3e41ae0"><code>655d311</code></a> Publish v3.1106.0</li> <li><a href="https://github.com/aws/aws-sdk-js-v3/commit/d6c0ea36225581e94befb619bc5df166fde4ba00"><code>d6c0ea3</code></a> Publish v3.1105.0</li> <li><a href="https://github.com/aws/aws-sdk-js-v3/commit/faf65602698bd9924362b5f1544b40f410cffb7d"><code>faf6560</code></a> feat(client-s3): AWS Backup now lets you create read-only access points for A...</li> <li><a href="https://github.com/aws/aws-sdk-js-v3/commit/b3929bd0a77d456d71c2f4b83351e324e30b7903"><code>b3929bd</code></a> Publish v3.1104.0</li> <li><a href="https://github.com/aws/aws-sdk-js-v3/commit/672c90ddc7cfee3049796eee74d2996e1b28b372"><code>672c90d</code></a> Publish v3.1103.0</li> <li><a href="https://github.com/aws/aws-sdk-js-v3/commit/c5285315f74404c8d2f537db46396897e1d6af95"><code>c528531</code></a> Publish v3.1102.0</li> <li><a href="https://github.com/aws/aws-sdk-js-v3/commit/272a6ebbaeffcb0e5e0b2a619365f2ff8404f0b5"><code>272a6eb</code></a> Publish v3.1101.0</li> <li><a href="https://github.com/aws/aws-sdk-js-v3/commit/6969cf9ed5814568d4fe6b8edcfc31d3eb982a85"><code>6969cf9</code></a> Publish v3.1100.0</li> <li><a href="https://github.com/aws/aws-sdk-js-v3/commit/5b15ca73a386ed9d90dc149d1533575c1fc7e08e"><code>5b15ca7</code></a> Publish v3.1099.0</li> <li><a href="https://github.com/aws/aws-sdk-js-v3/commit/ee76673ea9e59d184c4138ac6eec909b98d7fa43"><code>ee76673</code></a> Publish v3.1098.0</li> <li>Additional commits viewable in <a href="https://github.com/aws/aws-sdk-js-v3/commits/v3.1106.0/clients/client-s3">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
49b80e36f7 |
build(deps): bump dompurify from 3.4.12 to 3.4.13 (#11305)
Bumps [dompurify](https://github.com/cure53/DOMPurify) from 3.4.12 to 3.4.13. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/cure53/DOMPurify/releases">dompurify's releases</a>.</em></p> <blockquote> <h2>DOMPurify 3.4.13</h2> <ul> <li>Fixed an issue with hook removal during <code>IN_PLACE</code> sanitization, thanks <a href="https://github.com/koyokr"><code>@koyokr</code></a></li> <li>Fixed an issue with hooks potentially bypassing the clone guard, thanks <a href="https://github.com/AkshayjainG"><code>@AkshayjainG</code></a></li> <li>Fixed an issue with DOM clobbering via <code>ownerDocument</code> during <code>IN_PLACE</code>, thanks <a href="https://github.com/AkshayjainG"><code>@AkshayjainG</code></a></li> <li>Bumped several dependencies where possible</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/cure53/DOMPurify/commit/3067f774676975de12306effd6db6ad7a9a8c17f"><code>3067f77</code></a> release: 3.4.13 (<a href="https://redirect.github.com/cure53/DOMPurify/issues/1562">#1562</a>)</li> <li>See full diff in <a href="https://github.com/cure53/DOMPurify/compare/3.4.12...3.4.13">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/paperclipai/paperclip/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
70e6c80f5f |
build(deps-dev): bump @types/express-serve-static-core from 5.1.1 to 5.1.3 (#11320)
Bumps [@types/express-serve-static-core](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/express-serve-static-core) from 5.1.1 to 5.1.3. <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/express-serve-static-core">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Nicky LeachandPaperclip
|
b01f423cd7 |
fix(server): export manual OpenTelemetry spans (#10565)
## Thinking Path > - Paperclip uses the server to coordinate agent work. > - The server emits manual OpenTelemetry spans for startup, heartbeat, and sandbox execution. > - Those spans need the shared OpenTelemetry API package and a type-safe exporter path. > - Without the direct API dependency, the tracer stays no-op and the spans do not reach the collector. > - This pull request adds the direct dependency and the exporter cast. > - The benefit is that the manual spans can export cleanly at runtime. ## Linked Issues or Issue Description **What happened?** The server resolved the tracer with a runtime import, but `server` did not declare `@opentelemetry/api`. The manual spans stayed no-op, so the collector did not receive them. **Expected behavior** The server should load the shared OpenTelemetry API package, create the manual spans, and export them. **Steps to reproduce** 1. Start the server with telemetry enabled. 2. Run startup, heartbeat, or sandbox execution paths. 3. Observe that the manual spans do not export before this change. **Paperclip version or commit** `f91df236dfd8e5e6210941c80efeb0a7953bbe50` **Deployment mode** Built from source with `pnpm dev` or `pnpm build`. ## What Changed - Added `@opentelemetry/api` as a direct `server` dependency. - Cast the `traceExporter` value to `never` so the type check passes without a static `SpanExporter` import. - Kept the optional OTLP and SDK packages behind dynamic import. ## Verification - `pnpm build` in `server/` passed. - `server/src/instrumentation.ts` does not import `SpanExporter`. - `server/package.json` lists `@opentelemetry/api` at `^1.9.0`. ## Risks - Low risk. The change touches dependency metadata and one type cast. - Runtime telemetry still needs live collector QA. ## Model Used - OpenAI Codex, GPT-5, tool use enabled. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes: #` / `Refs: #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge Co-authored-by: Paperclip <noreply@paperclip.ing> |
||
|
dependabot[bot]
|
f9034ab3ca |
build(deps-dev): bump @types/node from 22.19.21 to 22.20.1 (#10304)
Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 22.19.21 to 22.20.1. <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
e95045905b |
build(deps): bump better-auth from 1.6.23 to 1.6.25 (#10306)
Bumps [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) from 1.6.23 to 1.6.25. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/better-auth/better-auth/releases">better-auth's releases</a>.</em></p> <blockquote> <h2>v1.6.25</h2> <h2><code>better-auth</code></h2> <h3>Bug Fixes</h3> <ul> <li>Fixed Apple OAuth not sending the PKCE code challenge during authorization, causing token exchange failures (<a href="https://redirect.github.com/better-auth/better-auth/pull/10294">#10294</a>)</li> <li>Fixed Google One Tap creating new users when sign-up was disabled on the Google provider (<a href="https://redirect.github.com/better-auth/better-auth/pull/10479">#10479</a>)</li> <li>Fixed <code>$fetch</code> and <code>$store</code> not being exposed on the Solid client (<a href="https://redirect.github.com/better-auth/better-auth/pull/10444">#10444</a>)</li> <li>Fixed internal adapter queries being routed to the wrong table when a built-in table's <code>modelName</code> was set to another table's schema key (e.g. <code>user.modelName = "account"</code>).</li> </ul> <p>For detailed changes, see <a href="https://github.com/better-auth/better-auth/blob/07a646ea190167370fbbb60a0fa2c3be3bec5522/packages/better-auth/CHANGELOG.md"><code>CHANGELOG</code></a></p> <h2>Contributors</h2> <p>Thanks to everyone who contributed to this release:</p> <p><a href="https://github.com/birkskyum"><code>@birkskyum</code></a>, <a href="https://github.com/jsj"><code>@jsj</code></a>, <a href="https://github.com/krish-vachhani"><code>@krish-vachhani</code></a></p> <p><strong>Full changelog:</strong> <a href="https://github.com/better-auth/better-auth/compare/v1.6.24...v1.6.25"><code>v1.6.24...v1.6.25</code></a></p> <h2>v1.6.24</h2> <h2><code>better-auth</code></h2> <h3>Features</h3> <ul> <li>Added request context (<code>ctx</code>) as a third argument to <code>verifyIdToken</code>, enabling custom ID token verifiers to read request headers (<a href="https://redirect.github.com/better-auth/better-auth/pull/10376">#10376</a>)</li> <li>Added <code>beforeStoreCookie</code> option to the last-login-method plugin for GDPR compliance (<a href="https://redirect.github.com/better-auth/better-auth/pull/5753">#5753</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li>Replaced flaky MongoDB where-coercion integration test with a direct unit test for more reliable test runs (<a href="https://redirect.github.com/better-auth/better-auth/pull/10369">#10369</a>)</li> <li>Fixed the <code>get-session</code> endpoint to include <code>no-store</code> cache control headers, preventing stale session data from being served (<a href="https://redirect.github.com/better-auth/better-auth/pull/10222">#10222</a>)</li> <li>Fixed SQLite migration diffs to recognize <code>BIGINT</code> as a valid number type, preventing spurious pending changes on rate limiter columns (<a href="https://redirect.github.com/better-auth/better-auth/pull/10316">#10316</a>)</li> <li>Fixed auth requests failing when request cloning throws an error inside verification callbacks (<a href="https://redirect.github.com/better-auth/better-auth/pull/10336">#10336</a>)</li> <li>Fixed <code>useSession({ throw: true })</code> incorrectly excluding <code>null</code> from its <code>data</code> type (<a href="https://redirect.github.com/better-auth/better-auth/pull/9787">#9787</a>)</li> <li>Fixed auth query revalidation and signal listeners not being restored after a client component remounts (<a href="https://redirect.github.com/better-auth/better-auth/pull/10379">#10379</a>)</li> <li>Fixed the <code>CookieAttributes</code> index signature type to be more precise (<a href="https://redirect.github.com/better-auth/better-auth/pull/10442">#10442</a>)</li> <li>Fixed silent misrouting of adapter queries when <code>user.modelName</code> was set to a value that collides with another schema key (<a href="https://redirect.github.com/better-auth/better-auth/pull/10235">#10235</a>)</li> <li>Fixed Kysely migration generation producing duplicate indexes for fields marked both <code>unique</code> and <code>index</code> (<a href="https://redirect.github.com/better-auth/better-auth/pull/10357">#10357</a>)</li> <li>Fixed magic-link and email-OTP send endpoints to validate the <code>Origin</code> header on cookieless requests, preventing cross-origin abuse (<a href="https://redirect.github.com/better-auth/better-auth/pull/10368">#10368</a>)</li> <li>Fixed remote MCP auth 401 challenge headers being hidden from browser clients due to missing CORS exposure (<a href="https://redirect.github.com/better-auth/better-auth/pull/10290">#10290</a>)</li> <li>Fixed OpenAPI schema to include plugin user fields (such as <code>username</code> and <code>displayUsername</code>) in <code>/sign-up/email</code> and <code>/update-user</code> request bodies (<a href="https://redirect.github.com/better-auth/better-auth/pull/10453">#10453</a>)</li> <li>Fixed <code>organization.listMembers</code> failing with "User not found for member" for organizations with more than ~100 members (<a href="https://redirect.github.com/better-auth/better-auth/pull/10342">#10342</a>)</li> <li>Fixed organization invitations to use database-generated IDs when <code>advanced.database.generateId</code> is configured, matching the behavior of other models (<a href="https://redirect.github.com/better-auth/better-auth/pull/10040">#10040</a>)</li> <li>Fixed <code>getDefaultModelName</code> to prefer exact schema key matches over <code>modelName</code> aliases, preventing adapter queries from being misrouted when a built-in table's name collides with another schema key</li> </ul> <p>For detailed changes, see <a href="https://github.com/better-auth/better-auth/blob/9a661c7b7abceaa81123b2c56757ee24f3ad2ed6/packages/better-auth/CHANGELOG.md"><code>CHANGELOG</code></a></p> <h2><code>auth</code></h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md">better-auth's changelog</a>.</em></p> <blockquote> <h2>1.6.25</h2> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/10479">#10479</a> <a href="https://github.com/better-auth/better-auth/commit/5124c3487903e96223bb3f54347724bb0204bb95"><code>5124c34</code></a> Thanks <a href="https://github.com/krish-vachhani"><code>@krish-vachhani</code></a>! - Prevent Google One Tap from creating new users when sign-up is disabled for the Google provider.</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/10444">#10444</a> <a href="https://github.com/better-auth/better-auth/commit/743935991f9991e8243d6c3d14773b9cfca462e8"><code>7439359</code></a> Thanks <a href="https://github.com/birkskyum"><code>@birkskyum</code></a>! - Expose the real <code>$fetch</code> instance and <code>$store</code> atoms from the Solid client instead of resolving them as dynamic API routes.</p> </li> <li> <p>Updated dependencies [<a href="https://github.com/better-auth/better-auth/commit/0ffd1fb28d44a8266d62791cd4c97e263444d03b"><code>0ffd1fb</code></a>]:</p> <ul> <li><code>@better-auth/core</code><a href="https://github.com/1"><code>@1</code></a>.6.25</li> <li><code>@better-auth/drizzle-adapter</code><a href="https://github.com/1"><code>@1</code></a>.6.25</li> <li><code>@better-auth/kysely-adapter</code><a href="https://github.com/1"><code>@1</code></a>.6.25</li> <li><code>@better-auth/memory-adapter</code><a href="https://github.com/1"><code>@1</code></a>.6.25</li> <li><code>@better-auth/mongo-adapter</code><a href="https://github.com/1"><code>@1</code></a>.6.25</li> <li><code>@better-auth/prisma-adapter</code><a href="https://github.com/1"><code>@1</code></a>.6.25</li> <li><code>@better-auth/telemetry</code><a href="https://github.com/1"><code>@1</code></a>.6.25</li> </ul> </li> </ul> <h2>1.6.24</h2> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/10235">#10235</a> <a href="https://github.com/better-auth/better-auth/commit/03dc5a046f536994950800ea557b8e2e2e0cdfdd"><code>03dc5a0</code></a> Thanks <a href="https://github.com/ping-maxwell"><code>@ping-maxwell</code></a>! - Fixes silent foreign-key and adapter-join misrouting when a user remaps a built-in model name to a string that collides with another schema key</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/10357">#10357</a> <a href="https://github.com/better-auth/better-auth/commit/750894037639c4158472cc1d4994b0e07bf1f59a"><code>7508940</code></a> Thanks <a href="https://github.com/c-nicol"><code>@c-nicol</code></a>! - Fixes Kysely migration generation for new-table fields that are both unique: true and index: true.</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/10342">#10342</a> <a href="https://github.com/better-auth/better-auth/commit/bae71988ab79aeb4f19f245ceabac9eca8706a50"><code>bae7198</code></a> Thanks <a href="https://github.com/ping-maxwell"><code>@ping-maxwell</code></a>! - Fix <code>organization.listMembers</code> failing with "User not found for member" for orgs with more than ~100 members by applying the same membership limit to the users query.</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/10336">#10336</a> <a href="https://github.com/better-auth/better-auth/commit/ef4d27360cec8a0bc11a94e135ea4a3dd32b1969"><code>ef4d273</code></a> Thanks <a href="https://github.com/Tushar-Khandelwal-2004"><code>@Tushar-Khandelwal-2004</code></a>! - Prevent verification callbacks from failing auth requests when cloning the request throws.</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/10333">#10333</a> <a href="https://github.com/better-auth/better-auth/commit/99dbdd7ea98740d11689394220a718dfb9579276"><code>99dbdd7</code></a> Thanks <a href="https://github.com/c-nicol"><code>@c-nicol</code></a>! - Fixes Drizzle schema generation for fields that are both unique: true and index: true.</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/10368">#10368</a> <a href="https://github.com/better-auth/better-auth/commit/086ca91f51dd8158aff6cbf54c4f9c7ce220914d"><code>086ca91</code></a> Thanks <a href="https://github.com/gaurav0107"><code>@gaurav0107</code></a>! - Force-validate the request <code>Origin</code> on the magic-link (<code>/sign-in/magic-link</code>) and email-otp (<code>/email-otp/send-verification-otp</code>) send endpoints, including cookieless requests, to match the built-in <code>/sign-in/email</code> and <code>/sign-up/email</code> routes. A cookieless cross-origin POST can no longer trigger a magic-link or verification-OTP email to an arbitrary address. Cookieless requests that carry no <code>Origin</code> (server-to-server) are unaffected.</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/10290">#10290</a> <a href="https://github.com/better-auth/better-auth/commit/8f2dedd89301da9fb52c1a64df6a9683f9be55fd"><code>8f2dedd</code></a> Thanks <a href="https://github.com/GautamBytes"><code>@GautamBytes</code></a>! - Expose the remote MCP auth client's 401 challenge headers to browser clients using CORS.</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/10453">#10453</a> <a href="https://github.com/better-auth/better-auth/commit/4e685eef420b5576913b9803b58c7e7ee7342203"><code>4e685ee</code></a> Thanks <a href="https://github.com/ping-maxwell"><code>@ping-maxwell</code></a>! - OpenAPI now includes <code>user.additionalFields</code> and plugin user schema fields (e.g. username plugin <code>username</code> / <code>displayUsername</code>) on <code>/sign-up/email</code> and <code>/update-user</code> request bodies.</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/10190">#10190</a> <a href="https://github.com/better-auth/better-auth/commit/3bf0e4981e025ba9af684013a27b0102a04f7c56"><code>3bf0e49</code></a> Thanks <a href="https://github.com/gaurav-init"><code>@gaurav-init</code></a>! - Pass the endpoint context as the second argument to <code>beforeDeleteOrganization</code> and <code>afterDeleteOrganization</code> hooks in the organization plugin, matching the signature shown in the docs and the existing <code>databaseHooks</code> pattern. The Stripe plugin's <code>beforeDeleteOrganization</code> wrapper now forwards the context to user-supplied hooks instead of dropping it.</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/10040">#10040</a> <a href="https://github.com/better-auth/better-auth/commit/f59a0ee7895a024ddd4c5c387344173888e17be4"><code>f59a0ee</code></a> Thanks <a href="https://github.com/shiminshen"><code>@shiminshen</code></a>! - Organization invitations now let the database generate their <code>id</code> when ID generation is delegated to the database (e.g. <code>advanced.database.generateId: "uuid"</code> with a UUID-capable adapter such as Postgres), matching every other model. Previously <code>createInvitation</code> always generated the invitation <code>id</code> in application code, so invitation rows received an app-generated value instead of a database-generated one while organizations, members and teams correctly deferred to the database (<a href="https://redirect.github.com/better-auth/better-auth/issues/10024">better-auth/better-auth#10024</a>). A caller-provided id (e.g. via <code>beforeCreateInvitation</code>) is still honored.</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/10302">#10302</a> <a href="https://github.com/better-auth/better-auth/commit/0f2cc1b33b77850948dac4d889e5f46bba41e8d5"><code>0f2cc1b</code></a> Thanks <a href="https://github.com/momomuchu"><code>@momomuchu</code></a>! - Prefer exact schema-key matches over <code>modelName</code> aliases in <code>getDefaultModelName</code>, so remapping a built-in table onto another table's schema key (e.g. <code>user.modelName = "account"</code>) does not reroute internal adapter queries to the wrong table.</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/9787">#9787</a> <a href="https://github.com/better-auth/better-auth/commit/ae781091186f321b4e4ec9e84f64b6e4d5ea1043"><code>ae78109</code></a> Thanks <a href="https://github.com/ping-maxwell"><code>@ping-maxwell</code></a>! - Fixes an issue where <code>useSession({ throw: true })</code> incorrectly excluded <code>null</code> from its <code>data</code> type.</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/10222">#10222</a> <a href="https://github.com/better-auth/better-auth/commit/46d2bf02c98902da7b344753372d48cfe0e5ebb3"><code>46d2bf0</code></a> Thanks <a href="https://github.com/ping-maxwell"><code>@ping-maxwell</code></a>! - fix: add no-store cache-control headers to get-session route</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/10316">#10316</a> <a href="https://github.com/better-auth/better-auth/commit/29a373eaf1778820061a9380c29831c2de2ce704"><code>29a373e</code></a> Thanks <a href="https://github.com/vinay-oppuri"><code>@vinay-oppuri</code></a>! - Recognize SQLite <code>BIGINT</code> as a valid number type in migration diffs so database-backed rate limiter columns like <code>lastRequest</code> no longer report spurious pending changes on every run.</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/10379">#10379</a> <a href="https://github.com/better-auth/better-auth/commit/f6d18fa8f79b9323e10b50f72e2b1a088844e4bb"><code>f6d18fa</code></a> Thanks <a href="https://github.com/ping-maxwell"><code>@ping-maxwell</code></a>! - fix(client): restore auth query revalidation and signal listeners after remount</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/better-auth/better-auth/commit/07a646ea190167370fbbb60a0fa2c3be3bec5522"><code>07a646e</code></a> chore: release v1.6.25 (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10491">#10491</a>)</li> <li><a href="https://github.com/better-auth/better-auth/commit/743935991f9991e8243d6c3d14773b9cfca462e8"><code>7439359</code></a> fix(solid): expose $fetch and $store on the solid client (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10444">#10444</a>)</li> <li><a href="https://github.com/better-auth/better-auth/commit/dac701c94bcd777e7cb124570d644f8b4a7981a5"><code>dac701c</code></a> chore(deps): bump next from 16.2.6 to 16.2.11 (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10493">#10493</a>)</li> <li><a href="https://github.com/better-auth/better-auth/commit/5124c3487903e96223bb3f54347724bb0204bb95"><code>5124c34</code></a> fix(one-tap): enforce google provider signup restrictions (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10479">#10479</a>)</li> <li><a href="https://github.com/better-auth/better-auth/commit/9a661c7b7abceaa81123b2c56757ee24f3ad2ed6"><code>9a661c7</code></a> chore: release v1.6.24 (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10323">#10323</a>)</li> <li><a href="https://github.com/better-auth/better-auth/commit/4e685eef420b5576913b9803b58c7e7ee7342203"><code>4e685ee</code></a> fix(open-api): include plugin user fields on sign-up/update bodies (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10453">#10453</a>)</li> <li><a href="https://github.com/better-auth/better-auth/commit/d3ce7823324ba64efd423895b1c122d85c6d7663"><code>d3ce782</code></a> fix(cookies): tighten CookieAttributes index signature type (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10441">#10441</a>) (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10442">#10442</a>)</li> <li><a href="https://github.com/better-auth/better-auth/commit/ae781091186f321b4e4ec9e84f64b6e4d5ea1043"><code>ae78109</code></a> fix(client): preserve null in useSession().data type with throw:true (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/9787">#9787</a>)</li> <li><a href="https://github.com/better-auth/better-auth/commit/f6d18fa8f79b9323e10b50f72e2b1a088844e4bb"><code>f6d18fa</code></a> fix(client): restore auth query lifecycle after remount (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10379">#10379</a>)</li> <li><a href="https://github.com/better-auth/better-auth/commit/086ca91f51dd8158aff6cbf54c4f9c7ce220914d"><code>086ca91</code></a> fix(magic-link, email-otp): force-validate Origin on cookieless send endpoint...</li> <li>Additional commits viewable in <a href="https://github.com/better-auth/better-auth/commits/v1.6.25/packages/better-auth">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
dc7f09be0d |
build(deps-dev): bump vitest from 4.1.8 to 4.1.10 (#9886)
Bumps [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) from 4.1.8 to 4.1.10. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vitest-dev/vitest/releases">vitest's releases</a>.</em></p> <blockquote> <h2>v4.1.10</h2> <h3> 🐞 Bug Fixes</h3> <ul> <li><strong>browser</strong>: Check fs access in builtin commands [backport to v4] - by <a href="https://github.com/hi-ogawa"><code>@hi-ogawa</code></a>, <strong>Hiroshi Ogawa</strong> and <strong>OpenCode (claude-opus-4-8)</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10680">vitest-dev/vitest#10680</a> <a href="https://github.com/vitest-dev/vitest/commit/5c18dd267"><!-- raw HTML omitted -->(5c18d)<!-- raw HTML omitted --></a></li> <li><strong>vm</strong>: Fix external module resolve error with deps optimizer query for encoded URI [backport to v4] - by <a href="https://github.com/SveLil"><code>@SveLil</code></a> and <a href="https://github.com/hi-ogawa"><code>@hi-ogawa</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10661">vitest-dev/vitest#10661</a> <a href="https://github.com/vitest-dev/vitest/commit/bae52b511"><!-- raw HTML omitted -->(bae52)<!-- raw HTML omitted --></a></li> </ul> <h5> <a href="https://github.com/vitest-dev/vitest/compare/v4.1.9...v4.1.10">View changes on GitHub</a></h5> <h2>v4.1.9</h2> <h3>🐞 Bug Fixes</h3> <ul> <li>Fix <code>importOriginal</code> with optimizer and query import [backport to v4] - by <strong>Hiroshi Ogawa</strong>, <strong>David Harris</strong>, <strong>Codex</strong>and <strong>Vladimir</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10546">vitest-dev/vitest#10546</a> <a href="https://github.com/vitest-dev/vitest/commit/a5180190c"><!-- raw HTML omitted -->(a5180)<!-- raw HTML omitted --></a></li> <li><strong>browser</strong>: <ul> <li>Wait for orchestrator readiness before resolving browser sessions [backport to v4] - by <strong>Vladimir</strong> and <strong>Séamus O'Connor</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10555">vitest-dev/vitest#10555</a> <a href="https://github.com/vitest-dev/vitest/commit/7fb29651a"><!-- raw HTML omitted -->(7fb29)<!-- raw HTML omitted --></a></li> <li>Wait for iframe tester readiness before preparing [backport to v4] - by <strong>Vladimir</strong> and <strong>Séamus O'Connor</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10497">vitest-dev/vitest#10497</a> and <a href="https://redirect.github.com/vitest-dev/vitest/issues/10556">vitest-dev/vitest#10556</a> <a href="https://github.com/vitest-dev/vitest/commit/fbc626c40"><!-- raw HTML omitted -->(fbc62)<!-- raw HTML omitted --></a></li> </ul> </li> <li><strong>mocker</strong>: <ul> <li>Hoist vi.mock() for vite-plus/test imports [backport to v4] - by <strong>Hiroshi Ogawa</strong>, <strong>LongYinan</strong>, <strong>Claude Opus 4.8</strong> and <strong>Vladimir</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10548">vitest-dev/vitest#10548</a> <a href="https://github.com/vitest-dev/vitest/commit/2c9559c02"><!-- raw HTML omitted -->(2c955)<!-- raw HTML omitted --></a></li> </ul> </li> <li><strong>pool</strong>: <ul> <li>Prevent test run hang on worker crash [backport to v4] - by <strong>Ari Perkkiö</strong> and <strong>Jattioui Ismail</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10543">vitest-dev/vitest#10543</a> and <a href="https://redirect.github.com/vitest-dev/vitest/issues/10564">vitest-dev/vitest#10564</a> <a href="https://github.com/vitest-dev/vitest/commit/934b0f587"><!-- raw HTML omitted -->(934b0)<!-- raw HTML omitted --></a></li> </ul> </li> </ul> <h5><a href="https://github.com/vitest-dev/vitest/compare/v4.1.8...v4.1.9">View changes on GitHub</a></h5> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vitest-dev/vitest/commit/db616d227b6e0cb07a94f5d1bba262ee95db7e46"><code>db616d2</code></a> chore: release v4.1.10 (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/10718">#10718</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/bae52b5112a6fd8200101b88bf8af9685d077295"><code>bae52b5</code></a> fix(vm): fix external module resolve error with deps optimizer query for enco...</li> <li><a href="https://github.com/vitest-dev/vitest/commit/a7a61e78c7d0718f00173cff6800a91a344457d4"><code>a7a61e7</code></a> chore: release v4.1.9 (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/10598">#10598</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/934b0f587cb61d8338d83f525295322692a2db40"><code>934b0f5</code></a> fix(pool): prevent test run hang on worker crash (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/10543">#10543</a>) [backport to v4] (#...</li> <li><a href="https://github.com/vitest-dev/vitest/commit/7fb29651afbae2a9b0cefe6c031a9308f168ac60"><code>7fb2965</code></a> fix(browser): wait for orchestrator readiness before resolving browser sessio...</li> <li><a href="https://github.com/vitest-dev/vitest/commit/a5180190c1be7089e3705e3dd9e84fea118d09d3"><code>a518019</code></a> fix: fix <code>importOriginal</code> with optimizer and query import [backport to v4] (#...</li> <li>See full diff in <a href="https://github.com/vitest-dev/vitest/commits/v4.1.10/packages/vitest">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
4d736b681d |
build(deps): bump ws from 8.19.0 to 8.21.1 (#9891)
Bumps [ws](https://github.com/websockets/ws) from 8.19.0 to 8.21.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/websockets/ws/releases">ws's releases</a>.</em></p> <blockquote> <h2>8.21.1</h2> <h1>Bug fixes</h1> <ul> <li>Empty fragments are now counted toward the limit (a2f4e7c0).</li> <li>The default values of the <code>maxBufferedChunks</code> and <code>maxFragments</code> options have been reduced (f197ac65).</li> </ul> <h2>8.21.0</h2> <h1>Features</h1> <ul> <li>Introduced the <code>maxBufferedChunks</code> and <code>maxFragments</code> options (2b2abd45).</li> </ul> <h1>Bug fixes</h1> <ul> <li>Fixed a remote memory exhaustion DoS vulnerability (2b2abd45).</li> </ul> <p>A high volume of tiny fragments and data chunks could be sent by a peer, using modest network traffic, to crash a <code>ws</code> server or client due to OOM.</p> <pre lang="js"><code>import { WebSocket, WebSocketServer } from 'ws'; <p>const wss = new WebSocketServer({ port: 0 }, function () { const data = Buffer.alloc(1); const options = { fin: false }; const { port } = wss.address(); const ws = new WebSocket(<code>ws://localhost:${port}</code>);</p> <p>ws.on('open', function () { (function send() { ws.send(data, options, function (err) { if (err) return; send(); }); })(); });</p> <p>ws.on('error', console.error); ws.on('close', function (code, reason) { console.log(<code>client close - code: ${code} reason: ${reason.toString()}</code>); }); });</p> <p>wss.on('connection', function (ws) { ws.on('error', console.error); ws.on('close', function (code, reason) { console.log(<code>server close - code: ${code} reason: ${reason.toString()}</code>); }); }); </code></pre></p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/websockets/ws/commit/ae1de54330cef77e487548890fabfeb9aae1d83d"><code>ae1de54</code></a> [dist] 8.21.1</li> <li><a href="https://github.com/websockets/ws/commit/8e9511b86b3fc6deebbd97dd9af7c9056deea8d1"><code>8e9511b</code></a> [ci] Trust Coveralls Homebrew tap</li> <li><a href="https://github.com/websockets/ws/commit/f197ac65140920bdcecdab74bfc69c2d7858e55d"><code>f197ac6</code></a> [fix] Lower default values of <code>maxBufferedChunks</code> and <code>maxFragments</code></li> <li><a href="https://github.com/websockets/ws/commit/8df8265c2f63fd44af3193a98e23cf38888cd991"><code>8df8265</code></a> [ci] Update actions/checkout action to v7</li> <li><a href="https://github.com/websockets/ws/commit/a2f4e7c046c2112bbce6fef39a083dac77d6f0d2"><code>a2f4e7c</code></a> [fix] Count empty fragments toward the limit (<a href="https://redirect.github.com/websockets/ws/issues/2329">#2329</a>)</li> <li><a href="https://github.com/websockets/ws/commit/e79f912cb3f492ae04c28feb9459a209e186b0ad"><code>e79f912</code></a> [pkg] Approve install scripts for bufferutil and utf-8-validate</li> <li><a href="https://github.com/websockets/ws/commit/4ea355d6d3069394994f82ca1b6d38c32ba208fb"><code>4ea355d</code></a> [doc] Document 32-bit signed integer coercion for option values</li> <li><a href="https://github.com/websockets/ws/commit/2120f4c8c625a76316792680a231496e1b615252"><code>2120f4c</code></a> [example] Remove uuid dependency</li> <li><a href="https://github.com/websockets/ws/commit/4c534a6b8a5224a563af116e85c6ced7d4ca60cf"><code>4c534a6</code></a> [security] Add latest vulnerability to SECURITY.md</li> <li><a href="https://github.com/websockets/ws/commit/bca91adf15677e47dbe4f959653452727be28b94"><code>bca91ad</code></a> [dist] 8.21.0</li> <li>Additional commits viewable in <a href="https://github.com/websockets/ws/compare/8.19.0...8.21.1">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
db61cc97d3 |
build(deps-dev): bump tsx from 4.22.4 to 4.23.1 (#9480)
Bumps [tsx](https://github.com/privatenumber/tsx) from 4.22.4 to 4.23.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/privatenumber/tsx/releases">tsx's releases</a>.</em></p> <blockquote> <h2>v4.23.1</h2> <h2><a href="https://github.com/privatenumber/tsx/compare/v4.23.0...v4.23.1">4.23.1</a> (2026-07-13)</h2> <h3>Bug Fixes</h3> <ul> <li>support tsImport after global preload (<a href="https://github.com/privatenumber/tsx/commit/8d4ffc24f37b396ca2fe3f251aa92c4919f2c1a4">8d4ffc2</a>)</li> <li><strong>watch:</strong> avoid clearing piped output (<a href="https://github.com/privatenumber/tsx/commit/95d0672e0247a829ae4469daa493212967ea768e">95d0672</a>)</li> <li><strong>watch:</strong> treat script and dependency paths literally (<a href="https://github.com/privatenumber/tsx/commit/79fddde523d3bb7d0af66682ce1265f95113a073">79fddde</a>)</li> </ul> <h3>Performance Improvements</h3> <ul> <li>index transform cache lazily (<a href="https://github.com/privatenumber/tsx/commit/e818ad608159a6fb36fb8a0bd59327fec313323d">e818ad6</a>)</li> <li>load esbuild lazily in CLI (<a href="https://github.com/privatenumber/tsx/commit/d0679381b60a55a9b5863603a4022a81db5d13c8">d067938</a>)</li> <li>map Node TypeScript formats directly (<a href="https://github.com/privatenumber/tsx/commit/cdcc6232a3277fb3028b226958b66c49a6d86c17">cdcc623</a>)</li> <li>use sync module hooks on Node v22.22.3+ (<a href="https://github.com/privatenumber/tsx/commit/f8992f1a50213e11b7ef8ab5121c78e0d2f29384">f8992f1</a>)</li> </ul> <hr /> <p>This release is also available on:</p> <ul> <li><a href="https://www.npmjs.com/package/tsx/v/4.23.1"><code>npm package (@latest dist-tag)</code></a></li> </ul> <h2>v4.23.0</h2> <h1><a href="https://github.com/privatenumber/tsx/compare/v4.22.5...v4.23.0">4.23.0</a> (2026-07-03)</h1> <h3>Bug Fixes</h3> <ul> <li>avoid redundant filesystem probes during module resolution (<a href="https://github.com/privatenumber/tsx/commit/257bbbb7eb2784cad6a3bb7a2d9c9747d28d96ec">257bbbb</a>), closes <a href="https://redirect.github.com/privatenumber/tsx/issues/809">privatenumber/tsx#809</a></li> </ul> <h3>Features</h3> <ul> <li>add multi-scenario startup benchmark suite (<a href="https://github.com/privatenumber/tsx/commit/c178197b104d055fd3431f7448982f3156394d12">c178197</a>), closes <a href="https://redirect.github.com/privatenumber/tsx/issues/809">privatenumber/tsx#809</a> <a href="https://redirect.github.com/privatenumber/tsx/issues/809">#809</a> <a href="https://github.com/hi/issues/signal">hi#signal</a> <a href="https://redirect.github.com/privatenumber/tsx/issues/145">privatenumber/tsx#145</a> <a href="https://redirect.github.com/privatenumber/tsx/issues/809">#809</a></li> </ul> <hr /> <p>This release is also available on:</p> <ul> <li><a href="https://www.npmjs.com/package/tsx/v/4.23.0"><code>npm package (@latest dist-tag)</code></a></li> </ul> <h2>v4.22.5</h2> <h2><a href="https://github.com/privatenumber/tsx/compare/v4.22.4...v4.22.5">4.22.5</a> (2026-07-02)</h2> <h3>Bug Fixes</h3> <ul> <li>isolate hook state per async module.register() registration (<a href="https://github.com/privatenumber/tsx/commit/a305f365f0cbcc31a44549dcbb0e63dc2883e96d">a305f36</a>)</li> </ul> <hr /> <p>This release is also available on:</p> <ul> <li><a href="https://www.npmjs.com/package/tsx/v/4.22.5"><code>npm package (@latest dist-tag)</code></a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/privatenumber/tsx/commit/79fddde523d3bb7d0af66682ce1265f95113a073"><code>79fddde</code></a> fix(watch): treat script and dependency paths literally</li> <li><a href="https://github.com/privatenumber/tsx/commit/e818ad608159a6fb36fb8a0bd59327fec313323d"><code>e818ad6</code></a> perf: index transform cache lazily</li> <li><a href="https://github.com/privatenumber/tsx/commit/cdcc6232a3277fb3028b226958b66c49a6d86c17"><code>cdcc623</code></a> perf: map Node TypeScript formats directly</li> <li><a href="https://github.com/privatenumber/tsx/commit/d0679381b60a55a9b5863603a4022a81db5d13c8"><code>d067938</code></a> perf: load esbuild lazily in CLI</li> <li><a href="https://github.com/privatenumber/tsx/commit/95d0672e0247a829ae4469daa493212967ea768e"><code>95d0672</code></a> fix(watch): avoid clearing piped output</li> <li><a href="https://github.com/privatenumber/tsx/commit/6fd4607e8a99d1efe27f185f749c659138f00ece"><code>6fd4607</code></a> docs: add per-page metadata</li> <li><a href="https://github.com/privatenumber/tsx/commit/f4176d8c6329a12205ed9b8c582e559cafc45018"><code>f4176d8</code></a> docs: generate sitemap</li> <li><a href="https://github.com/privatenumber/tsx/commit/8d4ffc24f37b396ca2fe3f251aa92c4919f2c1a4"><code>8d4ffc2</code></a> fix: support tsImport after global preload</li> <li><a href="https://github.com/privatenumber/tsx/commit/f0e89b244c98849dc5f9483fa33aaaf983ede18f"><code>f0e89b2</code></a> docs: document Node's public type-stripping API vs internal loader path</li> <li><a href="https://github.com/privatenumber/tsx/commit/f8992f1a50213e11b7ef8ab5121c78e0d2f29384"><code>f8992f1</code></a> perf: use sync module hooks on Node v22.22.3+</li> <li>Additional commits viewable in <a href="https://github.com/privatenumber/tsx/compare/v4.22.4...v4.23.1">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
072f1e9b8e |
build(deps): bump dompurify from 3.4.8 to 3.4.12 (#9478)
[//]: # (dependabot-start) ⚠️ **Dependabot is rebasing this PR** ⚠️ Rebasing might not happen immediately, so don't worry if this takes some time. Note: if you make any changes to this PR yourself, they will take precedence over the rebase. --- [//]: # (dependabot-end) Bumps [dompurify](https://github.com/cure53/DOMPurify) from 3.4.8 to 3.4.12. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/cure53/DOMPurify/releases">dompurify's releases</a>.</em></p> <blockquote> <h2>DOMPurify 3.4.12</h2> <ul> <li>Fixed an issue where a hook would not get called for custom elements, thanks <a href="https://github.com/Rikuxx0"><code>@Rikuxx0</code></a></li> <li>Hardened the handling of hooks removing elements, <a href="https://github.com/mkrause-bee360"><code>@mkrause-bee360</code></a></li> <li>Added support for a few new SVG attributes, thanks <a href="https://github.com/cbn-falias"><code>@cbn-falias</code></a> & <a href="https://github.com/Develop-KIM"><code>@Develop-KIM</code></a></li> <li>Hardened the handling of declarative partial updates</li> <li>Updated the documentation is several spots, README, wiki, etc.</li> <li>Bumped several dependencies where possible</li> </ul> <h2>DOMPurify 3.4.11</h2> <ul> <li>Fixed an issue with a leaky config for hooks via <code>setConfig</code>, thanks <a href="https://github.com/trace37labs"><code>@trace37labs</code></a></li> <li>Bumped vulnerable development dependencies to arrive at plain 0 with <code>npm audit</code></li> <li>Updated the <code>osv-scanner</code> suppression list as no vulnerable dependencies are left for now</li> <li>Updated up the linting tool-chain and removed now-redundant lint directives</li> <li>Updated the documentation is several spots, README, wiki, etc.</li> <li>Bumped several dependencies where possible</li> </ul> <h2>DOMPurify 3.4.10</h2> <ul> <li>Refactored codebase for clarity: extracted the public type declarations into <code>types.ts</code></li> <li>Decomposed the three largest sanitizer functions into focused helpers</li> <li>Removed duplicated defaults and dead branches, consolidated <code>SAFE_FOR_TEMPLATES</code> scrubbing into single shared path</li> <li>Improved per-node performance by hoisting the mXSS probe regexes and testing <code>textContent</code> before <code>innerHTML</code></li> <li>Added a deterministic micro-benchmark harness (<code>npm run bench</code>) with a <code>--compare</code> mode</li> <li>Reduced CI cost by running the full three-engine browser suite once per PR</li> <li>Refreshed the <code>demos/</code> folder so every demo runs again, and added a SVG-via-<code><img></code> demo</li> <li>Documented the bench and <code>test:happydom</code> scripts in the README</li> <li>Completed the Attack Classes & Bypass History wiki page</li> <li>Bumped several dependencies where possible</li> </ul> <h2>DOMPurify 3.4.9</h2> <ul> <li>Further improved the handling of Trusted Types config options, thanks <a href="https://github.com/offset"><code>@offset</code></a></li> <li>Further improved the handling of <code>IN_PLACE</code> sanitization, thanks <a href="https://github.com/mozfreddyb"><code>@mozfreddyb</code></a></li> <li>Added more test coverage for <code>IN_PLACE</code> and Trusted Types related usage</li> <li>Bumped several dependencies where possible</li> <li>Updated README and wiki with more accurate documentation & attack samples</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/cure53/DOMPurify/commit/a9ca1e537422319a557a9a2aa61f003b23b4a197"><code>a9ca1e5</code></a> release: 3.4.12 (<a href="https://redirect.github.com/cure53/DOMPurify/issues/1537">#1537</a>)</li> <li><a href="https://github.com/cure53/DOMPurify/commit/0cae5187403132f96a6d357649e4b15633fc210a"><code>0cae518</code></a> release: 3.4.11 (<a href="https://redirect.github.com/cure53/DOMPurify/issues/1494">#1494</a>)</li> <li><a href="https://github.com/cure53/DOMPurify/commit/6ee5716f8336989753611beeca364957c0eb0c3e"><code>6ee5716</code></a> release: 3.4.10 (<a href="https://redirect.github.com/cure53/DOMPurify/issues/1478">#1478</a>)</li> <li><a href="https://github.com/cure53/DOMPurify/commit/52102472d46035857c52df19e44285f8a1e102fc"><code>5210247</code></a> release: 3.4.9 (<a href="https://redirect.github.com/cure53/DOMPurify/issues/1459">#1459</a>)</li> <li>See full diff in <a href="https://github.com/cure53/DOMPurify/compare/3.4.8...3.4.12">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
f92a6648d5 |
build(deps): bump better-auth from 1.6.20 to 1.6.23 (#9479)
Bumps [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) from 1.6.20 to 1.6.23. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/better-auth/better-auth/releases">better-auth's releases</a>.</em></p> <blockquote> <h2>v1.6.23</h2> <h2><code>better-auth</code></h2> <h3>Features</h3> <ul> <li>Added Yandex as a social OAuth provider (<a href="https://redirect.github.com/better-auth/better-auth/pull/9138">#9138</a>)</li> </ul> <p>For detailed changes, see <a href="https://github.com/better-auth/better-auth/blob/9dfceee14021fc15a2fb93023f39635f25b0b5ba/packages/better-auth/CHANGELOG.md"><code>CHANGELOG</code></a></p> <h2><code>@better-auth/drizzle-adapter</code></h2> <h3>Bug Fixes</h3> <ul> <li>Fixed affected row counting for D1 and postgres-js adapters (<a href="https://redirect.github.com/better-auth/better-auth/pull/10257">#10257</a>)</li> </ul> <p>For detailed changes, see <a href="https://github.com/better-auth/better-auth/blob/9dfceee14021fc15a2fb93023f39635f25b0b5ba/packages/drizzle-adapter/CHANGELOG.md"><code>CHANGELOG</code></a></p> <h2><code>@better-auth/stripe</code></h2> <h3>Bug Fixes</h3> <ul> <li>Fixed organization subscription actions (cancel, upgrade, restore, and the billing portal) that could act on the wrong organization.</li> </ul> <p>For detailed changes, see <a href="https://github.com/better-auth/better-auth/blob/9dfceee14021fc15a2fb93023f39635f25b0b5ba/packages/stripe/CHANGELOG.md"><code>CHANGELOG</code></a></p> <h2><code>auth</code></h2> <h3>Bug Fixes</h3> <ul> <li>Fixed string default values not being properly escaped in the generated Drizzle schema (<a href="https://redirect.github.com/better-auth/better-auth/pull/10259">#10259</a>)</li> </ul> <p>For detailed changes, see <a href="https://github.com/better-auth/better-auth/blob/9dfceee14021fc15a2fb93023f39635f25b0b5ba/packages/cli/CHANGELOG.md"><code>CHANGELOG</code></a></p> <h2>Contributors</h2> <p>Thanks to everyone who contributed to this release:</p> <p><a href="https://github.com/bytaesu"><code>@bytaesu</code></a>, <a href="https://github.com/vladflotsky"><code>@vladflotsky</code></a></p> <p><strong>Full changelog:</strong> <a href="https://github.com/better-auth/better-auth/compare/v1.6.22...v1.6.23"><code>v1.6.22...v1.6.23</code></a></p> <h2>v1.6.22</h2> <h2><code>better-auth</code></h2> <h3>Bug Fixes</h3> <ul> <li>Fixed unproven credentials not being revoked during magic link and email OTP sign-in (<a href="https://redirect.github.com/better-auth/better-auth/pull/10239">#10239</a>)</li> <li>Fixed server-side OAuth requests to refuse redirect responses instead of following them (<a href="https://redirect.github.com/better-auth/better-auth/pull/10241">#10241</a>)</li> </ul> <p>For detailed changes, see <a href="https://github.com/better-auth/better-auth/blob/a90d061de7cdbd60e796230aadf5d1082add1fe2/packages/better-auth/CHANGELOG.md"><code>CHANGELOG</code></a></p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md">better-auth's changelog</a>.</em></p> <blockquote> <h2>1.6.23</h2> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/9138">#9138</a> <a href="https://github.com/better-auth/better-auth/commit/8581f97ea0000e03edd6aa7911efabf694a9ff95"><code>8581f97</code></a> Thanks <a href="https://github.com/vladflotsky"><code>@vladflotsky</code></a>! - Add a pre-configured Yandex provider helper for the generic OAuth plugin.</p> </li> <li> <p>Updated dependencies [<a href="https://github.com/better-auth/better-auth/commit/930b260cfd402e9f8886719a3ced503b9ceff7f6"><code>930b260</code></a>]:</p> <ul> <li><code>@better-auth/drizzle-adapter</code><a href="https://github.com/1"><code>@1</code></a>.6.23</li> <li><code>@better-auth/core</code><a href="https://github.com/1"><code>@1</code></a>.6.23</li> <li><code>@better-auth/kysely-adapter</code><a href="https://github.com/1"><code>@1</code></a>.6.23</li> <li><code>@better-auth/memory-adapter</code><a href="https://github.com/1"><code>@1</code></a>.6.23</li> <li><code>@better-auth/mongo-adapter</code><a href="https://github.com/1"><code>@1</code></a>.6.23</li> <li><code>@better-auth/prisma-adapter</code><a href="https://github.com/1"><code>@1</code></a>.6.23</li> <li><code>@better-auth/telemetry</code><a href="https://github.com/1"><code>@1</code></a>.6.23</li> </ul> </li> </ul> <h2>1.6.22</h2> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/10239">#10239</a> <a href="https://github.com/better-auth/better-auth/commit/c06a56d83a40bbaeac12d3a8b8b67e59f92a9110"><code>c06a56d</code></a> Thanks <a href="https://github.com/gustavovalverde"><code>@gustavovalverde</code></a>! - Magic-link and email-OTP sign-in now reset the credentials on an account whose email had never been confirmed. When verification resolves to such an account, any existing password on it is removed and its sessions are revoked before the user is signed in, so proven control of the mailbox is the source of truth for the account.</p> <p>If you signed up with email and password but first signed in through a magic link or email OTP rather than confirming the verification email, your password is cleared and you will need to set a new one through password reset.</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/10240">#10240</a> <a href="https://github.com/better-auth/better-auth/commit/3a035e968e27bfdee1e53ad857e5569090d9f2d1"><code>3a035e9</code></a> Thanks <a href="https://github.com/gustavovalverde"><code>@gustavovalverde</code></a>! - Add account-level lockout for two-factor verification. The attempt limit applies per account across sign-in challenges and across factors: TOTP, email-OTP, and backup codes share one counter, and a successful verification resets it.</p> <p>Enabled by default: an account locks for 15 minutes after 10 consecutive failed verifications, and locked attempts return <code>429</code> with the <code>ACCOUNT_TEMPORARILY_LOCKED</code> error code. Configure it with <code>twoFactor({ accountLockout: { enabled, maxFailedAttempts, durationSeconds } })</code>.</p> <p>Run a database migration after upgrading: this adds <code>failedVerificationCount</code> and <code>lockedUntil</code> columns to the <code>twoFactor</code> table.</p> </li> <li> <p>Updated dependencies [<a href="https://github.com/better-auth/better-auth/commit/8bd43d9d8312fd9ddbfb8fb5c827cf0a0e55132d"><code>8bd43d9</code></a>]:</p> <ul> <li><code>@better-auth/core</code><a href="https://github.com/1"><code>@1</code></a>.6.22</li> <li><code>@better-auth/drizzle-adapter</code><a href="https://github.com/1"><code>@1</code></a>.6.22</li> <li><code>@better-auth/kysely-adapter</code><a href="https://github.com/1"><code>@1</code></a>.6.22</li> <li><code>@better-auth/memory-adapter</code><a href="https://github.com/1"><code>@1</code></a>.6.22</li> <li><code>@better-auth/mongo-adapter</code><a href="https://github.com/1"><code>@1</code></a>.6.22</li> <li><code>@better-auth/prisma-adapter</code><a href="https://github.com/1"><code>@1</code></a>.6.22</li> <li><code>@better-auth/telemetry</code><a href="https://github.com/1"><code>@1</code></a>.6.22</li> </ul> </li> </ul> <h2>1.6.21</h2> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/10212">#10212</a> <a href="https://github.com/better-auth/better-auth/commit/e0762a127ce351a96614e60866b3455e6eddffa1"><code>e0762a1</code></a> Thanks <a href="https://github.com/bytaesu"><code>@bytaesu</code></a>! - In root-mounted deployments, requests whose path does not start with the configured <code>basePath</code> now return 404 instead of resolving to an endpoint.</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/10187">#10187</a> <a href="https://github.com/better-auth/better-auth/commit/882cf9e592d1d305b5b78cadbb10aaeee7acd6dc"><code>882cf9e</code></a> Thanks <a href="https://github.com/ping-maxwell"><code>@ping-maxwell</code></a>! - Admin permission changes and bans now take effect immediately for admin APIs, even when session cookie cache is enabled. Sensitive session checks also continue to work in stateless apps where signed cookies are the session record.</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/9939">#9939</a> <a href="https://github.com/better-auth/better-auth/commit/f52e1ab50b60d289b64d6b06f1bff5a4358cdfd0"><code>f52e1ab</code></a> Thanks <a href="https://github.com/benpsnyder"><code>@benpsnyder</code></a>! - fixes a bug causing deviceAuthorization() throwing a ZodError at construction when called without a schema option</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/10196">#10196</a> <a href="https://github.com/better-auth/better-auth/commit/b5bec193a56cec2f7b71c84d71dacb632f0b96a0"><code>b5bec19</code></a> Thanks <a href="https://github.com/Paola3stefania"><code>@Paola3stefania</code></a>! - OAuth sign-up and account-link profile sync now ignore provider profile values for user fields marked <code>input: false</code>. Input-allowed additional fields still persist from <code>mapProfileToUser</code>, and schema defaults still apply when OAuth creates a user. Apps that used <code>mapProfileToUser</code> to fill <code>input: false</code> fields should set those fields in server-side provisioning code instead.</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/better-auth/better-auth/commit/9dfceee14021fc15a2fb93023f39635f25b0b5ba"><code>9dfceee</code></a> chore: release v1.6.23 (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10260">#10260</a>)</li> <li><a href="https://github.com/better-auth/better-auth/commit/8581f97ea0000e03edd6aa7911efabf694a9ff95"><code>8581f97</code></a> feat(oauth): add Yandex social provider (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/9138">#9138</a>)</li> <li><a href="https://github.com/better-auth/better-auth/commit/a90d061de7cdbd60e796230aadf5d1082add1fe2"><code>a90d061</code></a> chore: release v1.6.22 (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10245">#10245</a>)</li> <li><a href="https://github.com/better-auth/better-auth/commit/3a035e968e27bfdee1e53ad857e5569090d9f2d1"><code>3a035e9</code></a> fix(two-factor): add account-level verification lockout (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10240">#10240</a>)</li> <li><a href="https://github.com/better-auth/better-auth/commit/c06a56d83a40bbaeac12d3a8b8b67e59f92a9110"><code>c06a56d</code></a> fix: revoke unproven credentials on magic-link/email-OTP sign-in (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10239">#10239</a>)</li> <li><a href="https://github.com/better-auth/better-auth/commit/414169d95a88a6e1fac41688bc7011e96feb0d2a"><code>414169d</code></a> chore: release v1.6.21 (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10184">#10184</a>)</li> <li><a href="https://github.com/better-auth/better-auth/commit/f52e1ab50b60d289b64d6b06f1bff5a4358cdfd0"><code>f52e1ab</code></a> fix(device-authorization): make <code>schema</code> option optional under Zod v4 (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/9939">#9939</a>)</li> <li><a href="https://github.com/better-auth/better-auth/commit/882cf9e592d1d305b5b78cadbb10aaeee7acd6dc"><code>882cf9e</code></a> fix(admin): use authoritative session reads for authorization (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10187">#10187</a>)</li> <li><a href="https://github.com/better-auth/better-auth/commit/b5bec193a56cec2f7b71c84d71dacb632f0b96a0"><code>b5bec19</code></a> fix(oauth): apply user input rules to provider profiles (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10196">#10196</a>)</li> <li><a href="https://github.com/better-auth/better-auth/commit/471f81c1ab088368de07383491535c1288fa6543"><code>471f81c</code></a> refactor: centralize request IP resolver in core (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10216">#10216</a>)</li> <li>Additional commits viewable in <a href="https://github.com/better-auth/better-auth/commits/v1.6.23/packages/better-auth">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
DottaandPaperclip
|
d166069bc4 |
Preserve built-in agent assets in server builds (#9339)
## Thinking Path > - Paperclip is the open source app people use to manage AI agents for work. > - The server package ships compiled runtime code plus static runtime assets. > - Built-in agent definitions live under `server/src/built-ins` and runtime code resolves them relative to compiled server files. > - The server build already copied onboarding assets into `dist`, but it did not copy built-in agent assets alongside the compiled code. > - Packaged server builds could therefore miss built-in agent definitions even though source-based development runs worked. > - This pull request extends the server build copy step to preserve built-in agent assets in `dist/built-ins`. > - The benefit is packaged server builds keep the same built-in agent runtime assets available as source-based development runs. ## Linked Issues or Issue Description No public GitHub issue found. This PR describes the underlying bug inline using the bug report template fields. ### What happened? `@paperclipai/server` build output copied `server/src/onboarding-assets` into `server/dist/onboarding-assets`, but did not copy `server/src/built-ins` into `server/dist/built-ins`. Runtime code for built-in agents resolves those assets relative to the compiled server files, so packaged builds could omit built-in agent markdown assets that are present during source-based development. ### Expected behavior Packaged server builds should include built-in agent assets under `server/dist/built-ins`, matching the runtime location expected by the compiled server code. ### Steps to reproduce 1. Check out current `master` before this PR. 2. Run `pnpm --filter @paperclipai/server build`. 3. Check for `server/dist/built-ins/agents/reflection-coach/AGENTS.md`. 4. Observe that the built-in agent asset is missing from the server build output. ### Paperclip version or commit Reproduces on current `master` before this PR. The fix is verified on commit `2b89984ccb7857f06359bf65c48222f110c7aeff`. ### Deployment mode Build/package artifact behavior. This can affect any deployment mode that runs from the built server package rather than directly from source. ### Installation method Built from source with `pnpm --filter @paperclipai/server build`. ### Agent adapter(s) involved Not adapter-specific. This is a core server packaging bug for built-in agent assets. ### Database mode Not database-related. ### Access context Not applicable. This happens during package build output generation. Related search: - Searched public PRs/issues for `built-ins build copy repo:paperclipai/paperclip`. - Found no directly related open issue. One old closed Hermes adapter PR was not directly related. ## What Changed - Updated the `@paperclipai/server` build script to create `dist/built-ins`. - Added the copy step from `server/src/built-ins` into `server/dist/built-ins` alongside the existing onboarding asset copy. - Added a focused server package build-script test that asserts both onboarding and built-in static runtime asset directories are copied into `dist`. ## Verification - `pnpm exec vitest run server/src/__tests__/server-package-build-script.test.ts` - `pnpm --filter @paperclipai/server build` - `test -f server/dist/built-ins/agents/reflection-coach/AGENTS.md` ## Risks Low risk. This changes only the package build asset copy step and adds focused test coverage. The main risk is build-script portability, but it follows the existing `mkdir -p` and `cp -R` pattern already used for onboarding assets. > For core feature work, check [`ROADMAP.md`](ROADMAP.md) first and discuss it in `#dev` before opening the PR. Feature PRs that overlap with planned core work may need to be redirected — check the roadmap first. See `CONTRIBUTING.md`. ## Model Used OpenAI Codex, GPT-5-based coding agent in a tool-enabled Paperclip heartbeat. Exact model ID and context-window size are not exposed in this runtime. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Paperclip <noreply@paperclip.ing> |
||
|
Devin FoleyandPaperclip
|
eedc7ddef2 |
Make ACP the default engine for local adapters (#9238)
## Thinking Path > - Paperclip is the open source app people use to manage AI agents for work. > - Adapter packages are the bridge between the control plane and local agent harnesses such as Claude Code, Codex, and Gemini CLI. > - ACP support was concentrated in a separate `acpx_local` adapter, which made ACP feel like a separate agent choice instead of an execution capability of the harness adapters. > - Claude, Codex, and Gemini now have ACP-capable harnesses, so the native adapter should own ACP selection, fallback, config, transcript parsing, and environment diagnostics. > - The standalone ACPX adapter still needs a compatibility path for existing rows, but it should not be offered as an active adapter for new agents. > - This pull request moves the shared ACP runtime into `@paperclipai/acpx-engine`, wires Claude/Codex/Gemini local adapters to prefer ACP when prerequisites are available, and retires `acpx_local` to a tombstone. > - The benefit is one adapter per harness, richer ACP transcripts by default where possible, and a migration path for existing Claude/Codex ACPX agents. ## Linked Issues or Issue Description Closes #5932 — the broken default `acpx_local` Claude path is replaced by native `claude_local` ACP support, existing Claude/Codex ACPX rows migrate to native adapters, and new agents no longer choose the standalone ACPX adapter. Refs #4893 — original merged ACPX local adapter runtime that this PR replaces with native per-harness ACP engines. Refs #6590 — prior ACPX-Claude seamlessness work folded into the new native Claude ACP path. Refs #197 — related open generic ACP/Kiro adapter work; this PR does not close it because Kiro/custom generic ACP remains a separate adapter decision. Refs #7018 — related Kimi-specific `acpx_local` shell failure; this PR retires the built-in standalone adapter but does not add a native Kimi adapter. Refs #8864 — related ACPX prompt/API guidance PR; this PR moves runtime guidance into the shared/native ACP engine path instead of the old standalone adapter. Refs #8881 — related `acpx_local` POSIX shell failure from the old `acpx` pin; this PR updates ACP dependencies but does not claim custom/OMP ACP support as a first-class native adapter. Refs #8964 — related open `acpx_local` stderr cleanup PR; this PR makes the old runtime path obsolete for new agents but keeps it as a non-closing reference. Problem description: - The standalone `acpx_local` adapter duplicates Claude/Codex agent choices that already have first-class local adapters. - ACP should be an execution engine capability of each harness adapter when the underlying harness supports ACP. - Existing `acpx_local` agents should either migrate to native harness adapters or fail with an explicit retirement message instead of silently falling back to the process adapter. ## What Changed - Added `@paperclipai/acpx-engine` as the shared ACP execution, session-codec, CLI formatter, and UI parser package. - Wired `claude_local`, `codex_local`, and `gemini_local` to auto-select ACP by default when prerequisites pass, with `engine=cli` opt-out and `engine=acp` strict mode. - Added ACP config schema/UI fields, environment checks, session-codec preservation, transcript parsing, and adapter capability metadata for the native adapters. - Retired `acpx_local` to a server tombstone, removed its UI/package/runtime image surface, and added a migration for existing Claude/Codex ACPX agents. - Updated package manifests, lockfile, release tooling, docs, Kubernetes sandbox defaults, and tests. ## Verification - `corepack pnpm --filter @paperclipai/acpx-engine typecheck` - `corepack pnpm --filter @paperclipai/adapter-claude-local typecheck` - `corepack pnpm --filter @paperclipai/adapter-codex-local typecheck` - `corepack pnpm --filter @paperclipai/adapter-gemini-local typecheck` - `corepack pnpm --filter @paperclipai/acpx-engine exec vitest run` - `corepack pnpm --filter @paperclipai/adapter-claude-local exec vitest run src/server/acp.test.ts src/server/execute.acp-fallback.test.ts src/ui/build-config.test.ts` - `corepack pnpm --filter @paperclipai/adapter-codex-local exec vitest run src/server/acp.test.ts src/ui/build-config.test.ts` - `corepack pnpm --filter @paperclipai/adapter-gemini-local exec vitest run src/server/acp.test.ts src/ui/build-config.test.ts src/ui/parse-stdout.test.ts` - `corepack pnpm --filter @paperclipai/plugin-sdk ensure-build-deps && corepack pnpm --filter @paperclipai/server exec tsc --noEmit` - `corepack pnpm --filter @paperclipai/server exec vitest run src/__tests__/adapter-routes.test.ts src/__tests__/adapter-session-codecs.test.ts src/__tests__/adapter-models.test.ts` - `corepack pnpm --filter @paperclipai/ui typecheck` - `corepack pnpm --filter @paperclipai/ui exec vitest run src/adapters/metadata.test.ts src/adapters/adapter-display-registry.test.ts src/components/AgentConfigForm.test.ts src/components/AgentConfigForm.render.test.tsx src/components/transcript/RunTranscriptView.test.tsx` - `node --test scripts/bootstrap-npm-package.test.mjs scripts/release-package-map.test.mjs scripts/verify-release-registry-state.test.mjs` Note: the server typecheck script calls `pnpm` internally; this dev shell exposes pnpm through Corepack only, so I ran the two script steps manually with `corepack pnpm`. ## Risks - Migration changes existing `acpx_local` Claude/Codex agents to native adapter types and clears old ACPX task sessions/runtime state. - Custom ACP commands remain on the retired tombstone and will need a separate future adapter/plugin path. - ACP auto-selection depends on local Node and ACP server command prerequisites; remote and unsupported environments fall back to CLI unless `engine=acp` is explicit. - `@paperclipai/acpx-engine` is a new public package and needs npm trusted-publishing bootstrap before release automation can publish it. > For core feature work, check [`ROADMAP.md`](ROADMAP.md) first and discuss it in `#dev` before opening the PR. Feature PRs that overlap with planned core work may need to be redirected — check the roadmap first. See `CONTRIBUTING.md`. ## Model Used OpenAI GPT-5 via Codex coding agent. Exact hosted model build and context-window size are not exposed in this runtime. Tool use included shell execution, repository editing, GitHub CLI operations, and local test/typecheck execution. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Paperclip <noreply@paperclip.ing> |
||
|
dependabot[bot]
|
bdd3aa2110 |
build(deps): bump sharp from 0.35.2 to 0.35.3 (#9061)
Bumps [sharp](https://github.com/lovell/sharp) from 0.35.2 to 0.35.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/lovell/sharp/releases">sharp's releases</a>.</em></p> <blockquote> <h2>v0.35.3</h2> <ul> <li> <p>Tighten verification of <code>text</code> dimensions, TIFF tile dimensions and <code>extend</code> values.</p> </li> <li> <p>Improve code bundler support by resolving path to libvips binary.</p> </li> <li> <p>Increase default concurrency when use of <code>MALLOC_ARENA_MAX</code> is detected.</p> </li> <li> <p>Emit warning about binaries provided by Electron for use on Linux.</p> </li> <li> <p>Add <code>hasAlpha</code> property to output <code>info</code>. <a href="https://redirect.github.com/lovell/sharp/issues/4500">#4500</a></p> </li> <li> <p>TypeScript: Return more precise <code>Buffer<ArrayBuffer></code> from <code>toBuffer</code>. <a href="https://redirect.github.com/lovell/sharp/pull/4520">#4520</a> <a href="https://github.com/Andarist"><code>@Andarist</code></a></p> </li> <li> <p>Bound <code>clahe</code> width and height to avoid signed overflow. <a href="https://redirect.github.com/lovell/sharp/pull/4551">#4551</a> <a href="https://github.com/metsw24-max"><code>@metsw24-max</code></a></p> </li> <li> <p>Bound <code>trim</code> margin to avoid signed overflow. <a href="https://redirect.github.com/lovell/sharp/pull/4552">#4552</a> <a href="https://github.com/metsw24-max"><code>@metsw24-max</code></a></p> </li> <li> <p>Reject infinite values when validating numbers. <a href="https://redirect.github.com/lovell/sharp/pull/4553">#4553</a> <a href="https://github.com/metsw24-max"><code>@metsw24-max</code></a></p> </li> <li> <p>Bound extract region to libvips coordinate limit. <a href="https://redirect.github.com/lovell/sharp/pull/4555">#4555</a> <a href="https://github.com/metsw24-max"><code>@metsw24-max</code></a></p> </li> <li> <p>Verify background colour values are numbers. <a href="https://redirect.github.com/lovell/sharp/pull/4556">#4556</a> <a href="https://github.com/metsw24-max"><code>@metsw24-max</code></a></p> </li> <li> <p>Bound create and raw input dimensions to coordinate limit. <a href="https://redirect.github.com/lovell/sharp/pull/4558">#4558</a> <a href="https://github.com/metsw24-max"><code>@metsw24-max</code></a></p> </li> <li> <p>Tighten recomb and affine matrix verification. <a href="https://redirect.github.com/lovell/sharp/pull/4560">#4560</a> <a href="https://github.com/chatman-media"><code>@chatman-media</code></a></p> </li> <li> <p>Verify cache memory limit to avoid overflow. <a href="https://redirect.github.com/lovell/sharp/pull/4561">#4561</a> <a href="https://github.com/metsw24-max"><code>@metsw24-max</code></a></p> </li> </ul> <h2>v0.35.3-rc.2</h2> <ul> <li>Tighten verification of <code>text</code> dimensions, TIFF tile dimensions and <code>extend</code> values.</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/lovell/sharp/commit/1018449164723ba0203c1beffaba0e21f7829c18"><code>1018449</code></a> Release v0.35.3</li> <li><a href="https://github.com/lovell/sharp/commit/ba303a799de6b0639a108e82465870ce0722ee4a"><code>ba303a7</code></a> Prerelease v0.35.3-rc.2</li> <li><a href="https://github.com/lovell/sharp/commit/4f94fc5162a488187be17872ba513d7cadfe22d6"><code>4f94fc5</code></a> Upgrade to sharp-libvips v1.3.2</li> <li><a href="https://github.com/lovell/sharp/commit/c5e7a3ff2043922b110dc9c00700c6f17d478c33"><code>c5e7a3f</code></a> Bump devDeps, fix Deno/Windows smoke tests</li> <li><a href="https://github.com/lovell/sharp/commit/9a8d00268893cf163eea638fcc05aaed65fe01ea"><code>9a8d002</code></a> Docs: Add changelog entry and note about transferable <a href="https://redirect.github.com/lovell/sharp/issues/4520">#4520</a></li> <li><a href="https://github.com/lovell/sharp/commit/8694db0bac0d227f183d05585ebac7d17048d123"><code>8694db0</code></a> TypeScript: Return more precise <code>Buffer\<ArrayBuffer></code> from <code>toBuffer</code> (<a href="https://redirect.github.com/lovell/sharp/issues/4520">#4520</a>)</li> <li><a href="https://github.com/lovell/sharp/commit/e000d0b5e128e05bb6c499600f37e2a6a4b74314"><code>e000d0b</code></a> Prerelease v0.35.3-rc.1</li> <li><a href="https://github.com/lovell/sharp/commit/9554ca95535e8385ec36815d7c793ce96739bf1c"><code>9554ca9</code></a> Prerelease v0.35.3-rc.0</li> <li><a href="https://github.com/lovell/sharp/commit/6a29fd55db0c569276f143a7b480c62573a7aa16"><code>6a29fd5</code></a> Emit warning about native binaries on Linux Electron</li> <li><a href="https://github.com/lovell/sharp/commit/540d2eada4613f954aa541ffac8c12485375967e"><code>540d2ea</code></a> Increase default concurrency when use of MALLOC_ARENA_MAX detected</li> <li>Additional commits viewable in <a href="https://github.com/lovell/sharp/compare/v0.35.2...v0.35.3">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
077ba611fa |
build(deps-dev): bump @types/multer from 2.1.0 to 2.2.0 (#9065)
Bumps [@types/multer](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/multer) from 2.1.0 to 2.2.0. <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/multer">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Devin FoleyandPaperclip
|
bcac517f3b |
Add browser SSH terminal for custom image setup (#8911)
## Thinking Path > - Paperclip is the open source app people use to manage AI agents for work. > - Environment sandboxes already support custom image creation and refresh through a temporary SSH setup session. > - The existing workflow makes operators copy an SSH command into an external terminal before they can install packages or make image changes. > - That extra context switch is slower, easier to get wrong, and less integrated with the setup session Paperclip already tracks. > - This pull request adds an embedded browser SSH terminal for custom image setup, so operators can start working in the target sandbox directly from the environment configuration flow. > - The implementation uses short-lived websocket attachment tokens, session-lifetime SSH host-key pinning, and server-managed terminal cleanup so the feature fits the existing setup-session boundary. > - The benefit is a smoother custom image creation and refresh experience without asking users to leave Paperclip for routine sandbox setup work. ## Linked Issues or Issue Description No public GitHub issue exists. ### Subsystem affected Cross-cutting: `server/` custom image setup APIs and websocket handling, `ui/` environment configuration UI, and shared custom image contracts. ### Problem or motivation Custom image creation and refresh require an operator to open a separate SSH client, paste the command shown by Paperclip, perform setup work, then return to the browser to finish the image flow. This is functional but awkward for a setup process that already starts and tracks a temporary sandbox session. ### Proposed solution Embed an SSH terminal in the custom image setup UI. When a setup session exposes an SSH payload, Paperclip should open a browser terminal backed by a server-side websocket session, let the operator run setup commands in-place, and then close the terminal when setup is finished, cancelled, expired, or disconnected. ### Alternatives considered - Keep the existing copy/paste SSH command workflow. This remains a fallback, but it does not streamline the common path. - Put SSH credentials directly into websocket URLs. This was avoided so terminal authentication can happen in an explicit first websocket auth frame rather than in logged URLs. - Trust the SSH host blindly for every reconnect. This PR instead pins the observed host-key fingerprint for the setup-session lifetime. ### Roadmap alignment This fits the roadmap theme of making agent workspaces usable in more remote and sandboxed environments while preserving Paperclip's control-plane model. ### Additional context Public GitHub search did not find a duplicate issue or PR for `custom image terminal ssh` in `paperclipai/paperclip`. ## What Changed - Added server-side terminal session tracking for custom image setup sessions, including connect-token issuance, websocket attachment, expiry, resize, input, and shutdown handling. - Added an embedded browser terminal to the custom image creation and refresh flow when a setup session provides SSH connection details. - Moved terminal token authentication out of the websocket URL and into the first websocket JSON auth frame. - Added SSH host-key SHA-256 pinning for each terminal session and documented the provider convention for username-embedded SSH credentials. - Updated the custom image environment API and UI so the setup terminal can open, reconnect, show status, authenticate, resize, and remain active for the setup-session lifetime once attached. - Kept custom image setup routes company-scoped and closed active terminal sessions on setup finish/cancel. - Added focused unit/integration/UI coverage for token expiry, setup-session expiry, websocket close paths, host-key pinning, and terminal session lifecycle behavior. - Removed the generated lockfile delta from the PR; CI owns temporary lockfile regeneration for manifest-changing PRs. ## Verification - `pnpm exec vitest run server/src/__tests__/server-startup-feedback-export.test.ts server/src/__tests__/environment-custom-image-terminal-ws.test.ts server/src/services/environment-custom-image-terminal-sessions.test.ts server/src/__tests__/environment-custom-image-routes.test.ts packages/shared/src/environment-custom-images.test.ts ui/src/pages/CompanyEnvironments.test.tsx` - 6 test files passed - 58 tests passed - `pnpm --filter @paperclipai/server typecheck` - `pnpm --filter @paperclipai/ui typecheck` - `pnpm --filter @paperclipai/server build` - `pnpm --filter @paperclipai/ui build` - `pnpm run typecheck:build-gaps` - `git diff --check` - Local sensitive-content scan over the PR diff using patterns for API keys, private keys, private hostnames, local paths, token fields, and credential-like strings. - Findings were limited to removed URL-token code and synthetic test placeholders such as `ssh-token-secret` and `terminal-token-terminal-token-123456`. - No real credentials, private hostnames, local filesystem paths, or instance-local links were found. - Remote PR checks were green after the implementation commit, including Build, Typecheck + Release Registry, General tests, serialized server suites, e2e, verify, Socket, Snyk, Superagent, and Greptile 5/5. - Post-merge PR hardening on July 3, 2026: merged `origin/master` at `47448721e` into the branch, resolved the `CompanyEnvironments.tsx` import conflict, reran focused tests, server/UI typechecks, server/UI builds, `pnpm run typecheck:build-gaps`, and `git diff --check`, scanned the final diff for sensitive content, pushed `4b43558cc`, and confirmed all remote checks plus Greptile 5/5 were green. - PR metadata correction on July 3, 2026: changed the title/body framing from bug-fix language to feature-request language. No source files changed for this metadata-only update. ## Risks - Moderate surface area because this adds websocket routing, setup-session runtime state, package dependencies, and a new custom image UI path. - New websocket attachments still require valid short-lived tokens; established terminal sessions remain bounded by setup-session expiry, explicit finish/cancel, client close, or server shutdown. - The terminal-session store is in-memory, so active terminal websocket tokens and host-key pins do not survive server restarts. - SSH host-key verification uses session-lifetime TOFU pinning because the current provider payload does not expose a trusted host-key fingerprint. - The external SSH command remains important as a fallback if a browser, proxy, or network environment cannot sustain the websocket terminal. > For core feature work, check [`ROADMAP.md`](ROADMAP.md) first and discuss it in `#dev` before opening the PR. Feature PRs that overlap with planned core work may need to be redirected — check the roadmap first. See `CONTRIBUTING.md`. ## Model Used OpenAI Codex, GPT-5 coding agent with shell/tool execution. Context window size was not exposed in this runtime. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Paperclip <noreply@paperclip.ing> |
||
|
dependabot[bot]
|
b755ab55fd |
build(deps): bump multer from 2.1.1 to 2.2.0 (#8743)
Bumps [multer](https://github.com/expressjs/multer) from 2.1.1 to 2.2.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/expressjs/multer/releases">multer's releases</a>.</em></p> <blockquote> <h2>v2.2.0</h2> <h2>Important</h2> <ul> <li>Fix <a href="https://www.cve.org/CVERecord?id=CVE-2026-5038">CVE-2026-5038</a> (<a href="https://github.com/expressjs/multer/security/advisories/GHSA-3p4h-7m6x-2hcm">GHSA-3p4h-7m6x-2hcm</a>)</li> <li>Fix <a href="https://www.cve.org/CVERecord?id=CVE-2026-5079">CVE-2026-5079</a> (<a href="https://github.com/expressjs/multer/security/advisories/GHSA-72gw-mp4g-v24j">GHSA-72gw-mp4g-v24j</a>)</li> </ul> <h2>What's Changed</h2> <ul> <li>chore(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/multer/pull/1397">expressjs/multer#1397</a></li> <li>chore(deps): bump github/codeql-action from 4.32.4 to 4.36.1 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/multer/pull/1409">expressjs/multer#1409</a></li> <li>chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/multer/pull/1410">expressjs/multer#1410</a></li> <li>ci: add Node 26 to test matrix by <a href="https://github.com/gameroman"><code>@gameroman</code></a> in <a href="https://redirect.github.com/expressjs/multer/pull/1404">expressjs/multer#1404</a></li> <li>Release: 2.2.0 by <a href="https://github.com/UlisesGascon"><code>@UlisesGascon</code></a> in <a href="https://redirect.github.com/expressjs/multer/pull/1412">expressjs/multer#1412</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/gameroman"><code>@gameroman</code></a> made their first contribution in <a href="https://redirect.github.com/expressjs/multer/pull/1404">expressjs/multer#1404</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/expressjs/multer/compare/v2.1.1...v2.2.0">https://github.com/expressjs/multer/compare/v2.1.1...v2.2.0</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/expressjs/multer/blob/main/CHANGELOG.md">multer's changelog</a>.</em></p> <blockquote> <h2>2.2.0</h2> <ul> <li>Fix <a href="https://www.cve.org/CVERecord?id=CVE-2026-5038">CVE-2026-5038</a> (<a href="https://github.com/expressjs/multer/security/advisories/GHSA-3p4h-7m6x-2hcm">GHSA-3p4h-7m6x-2hcm</a>)</li> <li>Fix <a href="https://www.cve.org/CVERecord?id=CVE-2026-5079">CVE-2026-5079</a> (<a href="https://github.com/expressjs/multer/security/advisories/GHSA-72gw-mp4g-v24j">GHSA-72gw-mp4g-v24j</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/expressjs/multer/commit/2e2af08157c66cbbc76539ccbd8869097a0c8feb"><code>2e2af08</code></a> 2.2.0 (<a href="https://redirect.github.com/expressjs/multer/issues/1412">#1412</a>)</li> <li><a href="https://github.com/expressjs/multer/commit/a192b5278f240967f5eb13dd1e9a413b4e1b6533"><code>a192b52</code></a> feat: add fieldNestingDepth limit option</li> <li><a href="https://github.com/expressjs/multer/commit/9c801c7136fdaa8437b84c6455cd46a3467a8058"><code>9c801c7</code></a> fix: clean up in-progress disk writes on abort</li> <li><a href="https://github.com/expressjs/multer/commit/0adb21d0294fe7315344feb6ddee00b0666d9e8a"><code>0adb21d</code></a> ci: add Node 26 to test matrix (<a href="https://redirect.github.com/expressjs/multer/issues/1404">#1404</a>)</li> <li><a href="https://github.com/expressjs/multer/commit/f5e17c39c818edade71b4deec7d114fdaafd54af"><code>f5e17c3</code></a> chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 (<a href="https://redirect.github.com/expressjs/multer/issues/1410">#1410</a>)</li> <li><a href="https://github.com/expressjs/multer/commit/de1fefd9d201f0ae48f1de056f00a349dd12f9bc"><code>de1fefd</code></a> chore(deps): bump github/codeql-action from 4.32.4 to 4.36.1 (<a href="https://redirect.github.com/expressjs/multer/issues/1409">#1409</a>)</li> <li><a href="https://github.com/expressjs/multer/commit/67abfc89f4caa5f842eb75083ddb3854db4cc38a"><code>67abfc8</code></a> chore(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (<a href="https://redirect.github.com/expressjs/multer/issues/1397">#1397</a>)</li> <li>See full diff in <a href="https://github.com/expressjs/multer/compare/v2.1.1...v2.2.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
d2fa57ab98 |
build(deps): bump sharp from 0.34.5 to 0.35.2 (#8739)
Bumps [sharp](https://github.com/lovell/sharp) from 0.34.5 to 0.35.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/lovell/sharp/releases">sharp's releases</a>.</em></p> <blockquote> <h2>v0.35.2</h2> <ul> <li> <p>TypeScript: Add <code>mediaType</code> to metadata response. <a href="https://redirect.github.com/lovell/sharp/issues/4492">#4492</a></p> </li> <li> <p>Improve WebAssembly fallback detection. <a href="https://redirect.github.com/lovell/sharp/issues/4513">#4513</a></p> </li> <li> <p>Improve code bundler support with stub binaries. <a href="https://redirect.github.com/lovell/sharp/issues/4543">#4543</a></p> </li> <li> <p>Verify GIF <code>effort</code> option is an integer. <a href="https://redirect.github.com/lovell/sharp/pull/4544">#4544</a> <a href="https://github.com/metsw24-max"><code>@metsw24-max</code></a></p> </li> <li> <p>Verify <code>recomb</code> matrix entries are numbers. <a href="https://redirect.github.com/lovell/sharp/pull/4545">#4545</a> <a href="https://github.com/metsw24-max"><code>@metsw24-max</code></a></p> </li> <li> <p>TypeScript: Replace namespace with named exports for ESM. <a href="https://redirect.github.com/lovell/sharp/issues/4546">#4546</a></p> </li> <li> <p>Bound dilate and erode width to avoid mask-size overflow. <a href="https://redirect.github.com/lovell/sharp/pull/4548">#4548</a> <a href="https://github.com/metsw24-max"><code>@metsw24-max</code></a></p> </li> <li> <p>Verify <code>convolve</code> kernel values are numbers. <a href="https://redirect.github.com/lovell/sharp/pull/4549">#4549</a> <a href="https://github.com/metsw24-max"><code>@metsw24-max</code></a></p> </li> </ul> <h2>v0.35.2-rc.2</h2> <ul> <li> <p>TypeScript: Add <code>mediaType</code> to metadata response. <a href="https://redirect.github.com/lovell/sharp/issues/4492">#4492</a></p> </li> <li> <p>Improve WebAssembly fallback detection. <a href="https://redirect.github.com/lovell/sharp/issues/4513">#4513</a></p> </li> <li> <p>Improve code bundler support with stub binaries. <a href="https://redirect.github.com/lovell/sharp/issues/4543">#4543</a></p> </li> <li> <p>Verify GIF <code>effort</code> option is an integer. <a href="https://redirect.github.com/lovell/sharp/pull/4544">#4544</a> <a href="https://github.com/metsw24-max"><code>@metsw24-max</code></a></p> </li> <li> <p>Verify <code>recomb</code> matrix entries are numbers. <a href="https://redirect.github.com/lovell/sharp/pull/4545">#4545</a> <a href="https://github.com/metsw24-max"><code>@metsw24-max</code></a></p> </li> <li> <p>TypeScript: Replace namespace with named exports for ESM. <a href="https://redirect.github.com/lovell/sharp/issues/4546">#4546</a></p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/lovell/sharp/commit/c9622a38edfc6fc709764152ea34332ba01619cf"><code>c9622a3</code></a> Release v0.35.2</li> <li><a href="https://github.com/lovell/sharp/commit/cd4568fd41e576345be3c5f774d22e441ac563ac"><code>cd4568f</code></a> Upgrade to sharp-libvips v1.3.1</li> <li><a href="https://github.com/lovell/sharp/commit/78390cf3d22a79c799727564eb1d0ff92d0e759b"><code>78390cf</code></a> Tests: Add font file to prevent font discovery flakiness (<a href="https://redirect.github.com/lovell/sharp/issues/4550">#4550</a>)</li> <li><a href="https://github.com/lovell/sharp/commit/61210b4d0a6972e83fa5a8cef47e04445114c1e1"><code>61210b4</code></a> Verify convolve kernel values are numbers (<a href="https://redirect.github.com/lovell/sharp/issues/4549">#4549</a>)</li> <li><a href="https://github.com/lovell/sharp/commit/1cb27dcca43d2bb3b43fad485d9d54ece0ee1f3e"><code>1cb27dc</code></a> Prerelease v0.35.2-rc.2</li> <li><a href="https://github.com/lovell/sharp/commit/c7606c3ca7d8364d36984f44bb81a45c4b7733fb"><code>c7606c3</code></a> Upgrade to sharp-libvips v1.3.1-rc.0</li> <li><a href="https://github.com/lovell/sharp/commit/29d1e9e4d318775590e332f95088cf7f741c8dca"><code>29d1e9e</code></a> Prerelease v0.35.2-rc.1</li> <li><a href="https://github.com/lovell/sharp/commit/bbba0a16bab7a6cc2b6f3023f3dc0337336b39bd"><code>bbba0a1</code></a> Improve code bundler support with stub binaries</li> <li><a href="https://github.com/lovell/sharp/commit/ab528662ea949f60421dc527640d3188894fb57f"><code>ab52866</code></a> Bound dilate and erode width to avoid mask-size overflow (<a href="https://redirect.github.com/lovell/sharp/issues/4548">#4548</a>)</li> <li><a href="https://github.com/lovell/sharp/commit/0f594dde40ed08c391810da38d994e923fcdfc24"><code>0f594dd</code></a> Prerelease v0.35.2-rc.0</li> <li>Additional commits viewable in <a href="https://github.com/lovell/sharp/compare/v0.34.5...v0.35.2">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
63aef57d49 |
build(deps): bump dotenv from 17.3.1 to 17.4.2 (#8737)
Bumps [dotenv](https://github.com/motdotla/dotenv) from 17.3.1 to 17.4.2. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md">dotenv's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/motdotla/dotenv/compare/v17.4.1...v17.4.2">17.4.2</a> (2026-04-12)</h2> <h3>Changed</h3> <ul> <li>Improved skill files - tightened up details (<a href="https://redirect.github.com/motdotla/dotenv/pull/1009">#1009</a>)</li> </ul> <h2><a href="https://github.com/motdotla/dotenv/compare/v17.4.0...v17.4.1">17.4.1</a> (2026-04-05)</h2> <h3>Changed</h3> <ul> <li>Change text <code>injecting</code> to <code>injected</code> (<a href="https://redirect.github.com/motdotla/dotenv/pull/1005">#1005</a>)</li> </ul> <h2><a href="https://github.com/motdotla/dotenv/compare/v17.3.1...v17.4.0">17.4.0</a> (2026-04-01)</h2> <h3>Added</h3> <ul> <li>Add <code>skills/</code> folder with focused agent skills: <code>skills/dotenv/SKILL.md</code> (core usage) and <code>skills/dotenvx/SKILL.md</code> (encryption, multiple environments, variable expansion) for AI coding agent discovery via the skills.sh ecosystem (<code>npx skills add motdotla/dotenv</code>)</li> </ul> <h3>Changed</h3> <ul> <li>Tighten up logs: <code>◇ injecting env (14) from .env</code> (<a href="https://redirect.github.com/motdotla/dotenv/pull/1003">#1003</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/motdotla/dotenv/commit/f116f70310abab44fbfddbaeb833698b5bf84a9b"><code>f116f70</code></a> 17.4.2</li> <li><a href="https://github.com/motdotla/dotenv/commit/3a8161274fdd745239b86e604f4a7e972a1d3902"><code>3a81612</code></a> fix visual order of faq</li> <li><a href="https://github.com/motdotla/dotenv/commit/13f55a89e136b2024e68d277b836dd5260fc16cf"><code>13f55a8</code></a> Merge branch 'skill'</li> <li><a href="https://github.com/motdotla/dotenv/commit/4bbbf73f0906bd69975c48bf310a84b686e5b1b4"><code>4bbbf73</code></a> reorganize faq</li> <li><a href="https://github.com/motdotla/dotenv/commit/c3da64bb2ba1d0e02f8b9b2b7ccb7e6f7a51d56c"><code>c3da64b</code></a> Merge pull request <a href="https://redirect.github.com/motdotla/dotenv/issues/1009">#1009</a> from motdotla/skill</li> <li><a href="https://github.com/motdotla/dotenv/commit/6f743b173fbd6c26f7eab7040d251f9a6c8b977d"><code>6f743b1</code></a> update source</li> <li><a href="https://github.com/motdotla/dotenv/commit/fc2c6247e858a32d4024cb06a5b0c79aa35851f5"><code>fc2c624</code></a> update skill</li> <li><a href="https://github.com/motdotla/dotenv/commit/972315ba74bb2bbba4483d112e853fd26006ef8a"><code>972315b</code></a> Tighten up skill</li> <li><a href="https://github.com/motdotla/dotenv/commit/2795fce3d1ed07b4c570f1e06ab1c0d533c86997"><code>2795fce</code></a> reorganize faq</li> <li><a href="https://github.com/motdotla/dotenv/commit/d5495d4ae8e4e41ef9a682c9e00c81552794274e"><code>d5495d4</code></a> adjust skill</li> <li>Additional commits viewable in <a href="https://github.com/motdotla/dotenv/compare/v17.3.1...v17.4.2">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
