[PR #3] chore(deps): bump the npm_and_yarn group across 6 directories with 13 updates #3

Open
opened 2026-06-05 14:30:23 -04:00 by yindo · 0 comments
Owner

📋 Pull Request Information

Original PR: https://github.com/Heretek-AI/heretek-openclaw-plugins/pull/3
Author: @dependabot[bot]
Created: 6/4/2026
Status: 🔄 Open

Base: mainHead: dependabot/npm_and_yarn/plugins/collective-comms/npm_and_yarn-c140e2be1e


📝 Commits (1)

  • c4963e4 chore(deps): bump the npm_and_yarn group across 6 directories with 13 updates

📊 Changes

6 files changed (+11436 additions, -30084 deletions)

View changed files

📝 plugins/collective-comms/package.json (+1 -1)
📝 plugins/openclaw-consciousness-plugin/package-lock.json (+1262 -5113)
📝 plugins/openclaw-hybrid-search-plugin/package-lock.json (+1928 -5844)
📝 plugins/openclaw-liberation-plugin/package-lock.json (+1206 -5036)
📝 plugins/openclaw-mcp-server/package-lock.json (+5802 -9026)
📝 plugins/openclaw-skill-extensions/package-lock.json (+1237 -5064)

📄 Description

Bumps the npm_and_yarn group with 1 update in the /plugins/collective-comms directory: vitest.
Bumps the npm_and_yarn group with 8 updates in the /plugins/openclaw-consciousness-plugin directory:

Package From To
@anthropic-ai/sdk 0.80.0 0.100.1
axios 1.14.0 1.17.0
basic-ftp 5.2.0 5.3.1
brace-expansion 5.0.5 5.0.6
fast-uri 3.1.0 3.1.2
fast-xml-builder 1.1.4 1.2.0
hono 4.12.9 removed
openclaw 2026.3.28 2026.6.1

Bumps the npm_and_yarn group with 8 updates in the /plugins/openclaw-hybrid-search-plugin directory:

Package From To
@anthropic-ai/sdk 0.81.0 0.100.1
axios 1.14.0 1.17.0
basic-ftp 5.2.0 5.3.1
brace-expansion 5.0.5 5.0.6
fast-uri 3.1.0 3.1.2
fast-xml-builder 1.1.4 1.2.0
hono 4.12.9 removed
openclaw 2026.4.1 2026.6.1

Bumps the npm_and_yarn group with 8 updates in the /plugins/openclaw-liberation-plugin directory:

Package From To
@anthropic-ai/sdk 0.81.0 0.100.1
axios 1.14.0 1.17.0
basic-ftp 5.2.0 5.3.1
brace-expansion 5.0.5 5.0.6
fast-uri 3.1.0 3.1.2
fast-xml-builder 1.1.4 1.2.0
hono 4.12.9 removed
openclaw 2026.4.1 2026.6.1

Bumps the npm_and_yarn group with 8 updates in the /plugins/openclaw-mcp-server directory:

Package From To
@anthropic-ai/sdk 0.80.0 0.100.1
axios 1.14.0 1.17.0
basic-ftp 5.2.0 5.3.1
brace-expansion 5.0.5 5.0.6
fast-uri 3.1.0 3.1.2
fast-xml-builder 1.1.4 1.2.0
hono 4.12.9 removed
openclaw 2026.3.28 2026.6.1

Bumps the npm_and_yarn group with 8 updates in the /plugins/openclaw-skill-extensions directory:

Package From To
@anthropic-ai/sdk 0.81.0 0.100.1
axios 1.14.0 1.17.0
basic-ftp 5.2.0 5.3.1
brace-expansion 5.0.5 5.0.6
fast-uri 3.1.0 3.1.2
fast-xml-builder 1.1.4 1.2.0
hono 4.12.9 removed
openclaw 2026.4.1 2026.6.1

Updates vitest from 1.6.1 to 4.1.8

Release notes

Sourced from vitest's releases.

v4.1.8

   🐞 Bug Fixes

    View changes on GitHub

v4.1.7

   🐞 Bug Fixes

    View changes on GitHub

v4.1.6

   🐞 Bug Fixes

   🏎 Performance

    View changes on GitHub

v4.1.5

   🚀 Experimental Features

   🐞 Bug Fixes

    View changes on GitHub

... (truncated)

Commits
  • e61f2dd chore: release v4.1.8
  • e4067b3 fix(browser): disable client cdp API when allowWrite/allowExec: false [ba...
  • a09d472 chore: release v4.1.7
  • a8fd24c chore: release v4.1.6
  • 18af98c fix(browser): simplify orchestrator otel carrier (#10285)
  • 3188260 feat(browser): provide project reference in ToMatchScreenshotResolvePath (#...
  • e399846 chore: release v4.1.5
  • 7dc6d54 Revert "fix: respect diff config options in soft assertions (#8696)"
  • 9787ded fix: respect diff config options in soft assertions (#8696)
  • 325463a fix(ast-collect): recognize _vi_import prefix in static test discovery (#10...
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for vitest since your current version.


Updates @anthropic-ai/sdk from 0.80.0 to 0.100.1

Release notes

Sourced from @​anthropic-ai/sdk's releases.

sdk: v0.100.1

0.100.1 (2026-05-29)

Full Changelog: sdk-v0.100.0...sdk-v0.100.1

Bug Fixes

  • streaming: carry encrypted_content on beta compaction blocks (#1025) (eccddf3)

Chores

  • client: update lockfiles to have proper dependencies on standardwebhooks (5e9b523)

sdk: v0.100.0

0.100.0 (2026-05-28)

Full Changelog: sdk-v0.99.0...sdk-v0.100.0

Features

  • api: Add support for claude-opus-4-8, mid-conversation system blocks, and usage.output_tokens_details (bb0bf27)

Documentation

  • replace literal newlines (66ba142)

sdk: v0.99.0

0.99.0 (2026-05-27)

Full Changelog: sdk-v0.98.1...sdk-v0.99.0

Features

Bug Fixes

  • streaming: carry stop_details through message_delta accumulation (#1027) (198bc27)

sdk: v0.98.1

0.98.1 (2026-05-26)

Full Changelog: sdk-v0.98.0...sdk-v0.98.1

Bug Fixes

  • client: preserve directory prefix in skills.versions.create uploads (#1024) (abbcd6a)

... (truncated)

Changelog

Sourced from @​anthropic-ai/sdk's changelog.

0.100.1 (2026-05-29)

Full Changelog: sdk-v0.100.0...sdk-v0.100.1

Bug Fixes

  • streaming: carry encrypted_content on beta compaction blocks (#1025) (eccddf3)

Chores

  • client: update lockfiles to have proper dependencies on standardwebhooks (5e9b523)

0.100.0 (2026-05-28)

Full Changelog: sdk-v0.99.0...sdk-v0.100.0

Features

  • api: Add support for claude-opus-4-8, mid-conversation system blocks, and usage.output_tokens_details (bb0bf27)

Documentation

  • replace literal newlines (66ba142)

0.99.0 (2026-05-27)

Full Changelog: sdk-v0.98.1...sdk-v0.99.0

Features

Bug Fixes

  • streaming: carry stop_details through message_delta accumulation (#1027) (198bc27)

0.98.1 (2026-05-26)

Full Changelog: sdk-v0.98.0...sdk-v0.98.1

Bug Fixes

  • client: preserve directory prefix in skills.versions.create uploads (#1024) (abbcd6a)

Chores

... (truncated)

Commits
  • 512605f chore: release main
  • d0148df codegen metadata
  • 4d836b4 codegen metadata
  • 323e350 codegen metadata
  • ea36df7 chore(client): update lockfiles to have proper dependencies on standardwebhooks
  • 0ea1922 codegen metadata
  • 991d88f fix(streaming): carry encrypted_content on beta compaction blocks (#1025)
  • 6f97c4d chore: release main
  • 1fd7ec7 feat(api): Add support for claude-opus-4-8, mid-conversation system blocks, a...
  • f5bfc10 docs: replace literal newlines
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​anthropic-ai/sdk since your current version.


Updates axios from 1.14.0 to 1.17.0

Release notes

Sourced from axios's releases.

v1.17.0 — June 1, 2026

This release adds Node HTTP zstd decompression, hardens config and release workflows, and fixes authentication, header, proxy, and type-handling regressions.

🔒 Security Fixes

  • Config Hardening: Guarded socketPath, params, and paramsSerializer reads with own-property checks to prevent inherited prototype values from affecting request behavior, including SSRF-sensitive paths. (#10901, #10922)
  • Release Publishing: Switched the publish workflow to npm staged publishing for safer, auditable package releases with provenance. (#10926)

🚀 New Features

  • HTTP Compression: Added Node HTTP adapter support for zstd response decompression, with transitional.advertiseZstdAcceptEncoding controlling whether zstd is advertised in Accept-Encoding. (#6792, #10920)

🐛 Bug Fixes

  • Authentication Handling: Restored Basic auth on same-origin Node redirects while continuing to strip credentials cross-origin, and aligned the fetch adapter with HTTP adapter behavior for URL-embedded Basic auth. (#10929, #10896)
  • Proxy TLS: Preserved user httpsAgent TLS options when tunneling HTTPS requests through HTTP CONNECT proxies. (#10957)
  • React Native FormData: Cleared default Content-Type for React Native FormData so multipart boundaries can be generated correctly. (#10898)
  • Headers: Silently skipped empty or whitespace-only header names instead of throwing, matching parsed-header behavior and avoiding React Native response crashes. (#10875)
  • Request Data Merging: Preserved enumerable symbol keys when cloning plain request data through axios merge logic. (#10812)
  • Bundler Compatibility: Converted resolveConfig from an arrow default export to a named function export to avoid webpack and Babel transform interop failures. (#10891)
  • Types: Corrected AxiosHeaders.toJSON() return types and updated CommonJS isCancel typings to narrow to CanceledError<T>. (#10956, #10952)
  • Build Tooling: Avoided emitting a null Authorization header from the GitHub build helper when GITHUB_TOKEN is unset. (#10931)

🔧 Maintenance & Chores

  • HTTP/2 Internals: Extracted Http2Sessions into its own helper module and added direct unit coverage for session pooling, timeout, and cleanup behavior. (#10861)
  • Package Publishing: Reduced published package size by switching to a files allowlist and dropping unneeded unminified bundle source maps. (#10939)
  • CI and Release Automation: Added bundle-size reporting, moved reports to the job summary, fixed bundle-size comparison coverage, added Node 26 to the matrix, pinned npm for staged publishing, and prepared the 1.17.0 release. (#10907, #10911, #10916, #10927, #10935, #10983)
  • Developer Workflow: Added a dev container and iterated on OpenSpec workflow files before removing them from the release branch. (#10925, #10914, #10958)
  • Documentation and Policy: Updated disclosure, contributor, collaboration, threat-model, advanced docs, README badges, release notes, moderator configuration, and project metadata. (#10890, #10889, #10921, #10945, #10905, #10933, #10915, #10887, #10955)
  • Dependencies: Bumped Babel tooling, Commitlint, ESLint, Rollup, Globals, Vitest, Playwright, fs-extra, qs, docs dependencies, and GitHub Actions dependencies including actions/dependency-review-action and zizmorcore/zizmor-action. (#10871, #10879, #10918, #10919, #10934, #10947, #10954, #10960)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

Full Changelog

... (truncated)

Changelog

Sourced from axios's changelog.

v1.17.0 — June 1, 2026

This release adds Node HTTP zstd decompression, hardens config and release workflows, and fixes authentication, header, proxy, and type-handling regressions.

🔒 Security Fixes

  • Config Hardening: Guarded socketPath, params, and paramsSerializer reads with own-property checks to prevent inherited prototype values from affecting request behavior, including SSRF-sensitive paths. (#10901, #10922)
  • Release Publishing: Switched the publish workflow to npm staged publishing for safer, auditable package releases with provenance. (#10926)

🚀 New Features

  • HTTP Compression: Added Node HTTP adapter support for zstd response decompression, with transitional.advertiseZstdAcceptEncoding controlling whether zstd is advertised in Accept-Encoding. (#6792, #10920)

🐛 Bug Fixes

  • Authentication Handling: Restored Basic auth on same-origin Node redirects while continuing to strip credentials cross-origin, and aligned the fetch adapter with HTTP adapter behavior for URL-embedded Basic auth. (#10929, #10896)
  • Proxy TLS: Preserved user httpsAgent TLS options when tunneling HTTPS requests through HTTP CONNECT proxies. (#10957)
  • React Native FormData: Cleared default Content-Type for React Native FormData so multipart boundaries can be generated correctly. (#10898)
  • Headers: Silently skipped empty or whitespace-only header names instead of throwing, matching parsed-header behavior and avoiding React Native response crashes. (#10875)
  • Request Data Merging: Preserved enumerable symbol keys when cloning plain request data through axios merge logic. (#10812)
  • Bundler Compatibility: Converted resolveConfig from an arrow default export to a named function export to avoid webpack and Babel transform interop failures. (#10891)
  • Types: Corrected AxiosHeaders.toJSON() return types and updated CommonJS isCancel typings to narrow to CanceledError<T>. (#10956, #10952)
  • Build Tooling: Avoided emitting a null Authorization header from the GitHub build helper when GITHUB_TOKEN is unset. (#10931)

🔧 Maintenance & Chores

  • HTTP/2 Internals: Extracted Http2Sessions into its own helper module and added direct unit coverage for session pooling, timeout, and cleanup behavior. (#10861)
  • Package Publishing: Reduced published package size by switching to a files allowlist and dropping unneeded unminified bundle source maps. (#10939)
  • CI and Release Automation: Added bundle-size reporting, moved reports to the job summary, fixed bundle-size comparison coverage, added Node 26 to the matrix, pinned npm for staged publishing, and prepared the 1.17.0 release. (#10907, #10911, #10916, #10927, #10935, #10983)
  • Developer Workflow: Added a dev container and iterated on OpenSpec workflow files before removing them from the release branch. (#10925, #10914, #10958)
  • Documentation and Policy: Updated disclosure, contributor, collaboration, threat-model, advanced docs, README badges, release notes, moderator configuration, and project metadata. (#10890, #10889, #10921, #10945, #10905, #10933, #10915, #10887, #10955)
  • Dependencies: Bumped Babel tooling, Commitlint, ESLint, Rollup, Globals, Vitest, Playwright, fs-extra, qs, docs dependencies, and GitHub Actions dependencies including actions/dependency-review-action and zizmorcore/zizmor-action. (#10871, #10879, #10918, #10919, #10934, #10947, #10954, #10960)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

Full Changelog

... (truncated)

Commits

Updates basic-ftp from 5.2.0 to 5.3.1

Release notes

Sourced from basic-ftp's releases.

5.3.1

5.3.0

5.2.2

5.2.1

Changelog

Sourced from basic-ftp's changelog.

5.3.1

5.3.0

5.2.2

5.2.1

Commits
Maintainer changes

This version was pushed to npm by patrickjuchli, a new releaser for basic-ftp since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


Updates brace-expansion from 5.0.5 to 5.0.6

Commits

Updates fast-uri from 3.1.0 to 3.1.2

Release notes

Sourced from fast-uri's releases.

v3.1.2

⚠️ Security Release

What's Changed

Full Changelog: https://github.com/fastify/fast-uri/compare/v3.1.1...v3.1.2

v3.1.1

⚠️ Security Release

What's Changed

New Contributors

Full Changelog: https://github.com/fastify/fast-uri/compare/v3.1.0...v3.1.1

Commits
  • 919dd8e Bumped v3.1.2
  • c65ba57 fixup: linting
  • 6c86c17 Merge commit from fork
  • a95158a Handle malformed fragment decoding without throwing (#171)
  • cea547c Bumped v3.1.1
  • 876ce79 Merge commit from fork
  • dcdf690 ci: add lock-threads workflow (#169)
  • c860e65 build(deps-dev): bump neostandard from 0.12.2 to 0.13.0 (#167)
  • 9b4c6dc build(deps): bump fastify/workflows/.github/workflows/plugins-ci.yml (#166)
  • 85d09a9 build(deps): bump fastify/workflows/.github/workflows/plugins-ci-package-mana...
  • Additional commits viewable in compare view

Updates fast-xml-builder from 1.1.4 to 1.2.0

Changelog

Sourced from fast-xml-builder's changelog.

1.2.0 (2026-05-08)

  • Add support for sanitizeName option
  • Support xml-naming for validating and sanitizing tag and attribute names

1.1.9 (2026-05-06)

  • fix: format output for preserve order when indent by is set to empty string

1.1.8 (2026-05-05)

  • fix: skip text property for PI tags
  • improve typings

1.1.7 (2026--05-04)

  • fix security issues when attribute value contains quotes

1.1.6 (2026--05-04)

  • fix security issues related to comment
  • skip comment with null value

1.1.5 (2026-04-17)

  • fix security issues related to comment and cdata

1.1.4 (2026-03-16)

  • support maxNestedTags option

1.1.3 (2026-03-13)

  • declare Matcher & Expression as unknown so user is not forced to install path-expression-matcher

1.1.2 (2026-03-11)

  • fix typings

1.1.1 (2026-03-11)

  • upgrade path-expression-matcher to 1.1.3

1.1.0 (2026-03-10)

Commits

Removes hono

Updates openclaw from 2026.3.28 to 2026.6.1

Release notes

Sourced from openclaw's releases.

openclaw 2026.6.1

Highlights

  • Agents and CLI-backed runtimes recover more cleanly from interrupted tool calls, stale session bin...

    Description has been truncated


    🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/Heretek-AI/heretek-openclaw-plugins/pull/3 **Author:** [@dependabot[bot]](https://github.com/apps/dependabot) **Created:** 6/4/2026 **Status:** 🔄 Open **Base:** `main` ← **Head:** `dependabot/npm_and_yarn/plugins/collective-comms/npm_and_yarn-c140e2be1e` --- ### 📝 Commits (1) - [`c4963e4`](https://github.com/Heretek-AI/heretek-openclaw-plugins/commit/c4963e4c9aa3da14e85d7c6dfe4c6ba6f0910e04) chore(deps): bump the npm_and_yarn group across 6 directories with 13 updates ### 📊 Changes **6 files changed** (+11436 additions, -30084 deletions) <details> <summary>View changed files</summary> 📝 `plugins/collective-comms/package.json` (+1 -1) 📝 `plugins/openclaw-consciousness-plugin/package-lock.json` (+1262 -5113) 📝 `plugins/openclaw-hybrid-search-plugin/package-lock.json` (+1928 -5844) 📝 `plugins/openclaw-liberation-plugin/package-lock.json` (+1206 -5036) 📝 `plugins/openclaw-mcp-server/package-lock.json` (+5802 -9026) 📝 `plugins/openclaw-skill-extensions/package-lock.json` (+1237 -5064) </details> ### 📄 Description Bumps the npm_and_yarn group with 1 update in the /plugins/collective-comms directory: [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest). Bumps the npm_and_yarn group with 8 updates in the /plugins/openclaw-consciousness-plugin directory: | Package | From | To | | --- | --- | --- | | [@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript) | `0.80.0` | `0.100.1` | | [axios](https://github.com/axios/axios) | `1.14.0` | `1.17.0` | | [basic-ftp](https://github.com/patrickjuchli/basic-ftp) | `5.2.0` | `5.3.1` | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `5.0.5` | `5.0.6` | | [fast-uri](https://github.com/fastify/fast-uri) | `3.1.0` | `3.1.2` | | [fast-xml-builder](https://github.com/NaturalIntelligence/fast-xml-builder) | `1.1.4` | `1.2.0` | | [hono](https://github.com/honojs/hono) | `4.12.9` | `removed` | | [openclaw](https://github.com/openclaw/openclaw) | `2026.3.28` | `2026.6.1` | Bumps the npm_and_yarn group with 8 updates in the /plugins/openclaw-hybrid-search-plugin directory: | Package | From | To | | --- | --- | --- | | [@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript) | `0.81.0` | `0.100.1` | | [axios](https://github.com/axios/axios) | `1.14.0` | `1.17.0` | | [basic-ftp](https://github.com/patrickjuchli/basic-ftp) | `5.2.0` | `5.3.1` | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `5.0.5` | `5.0.6` | | [fast-uri](https://github.com/fastify/fast-uri) | `3.1.0` | `3.1.2` | | [fast-xml-builder](https://github.com/NaturalIntelligence/fast-xml-builder) | `1.1.4` | `1.2.0` | | [hono](https://github.com/honojs/hono) | `4.12.9` | `removed` | | [openclaw](https://github.com/openclaw/openclaw) | `2026.4.1` | `2026.6.1` | Bumps the npm_and_yarn group with 8 updates in the /plugins/openclaw-liberation-plugin directory: | Package | From | To | | --- | --- | --- | | [@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript) | `0.81.0` | `0.100.1` | | [axios](https://github.com/axios/axios) | `1.14.0` | `1.17.0` | | [basic-ftp](https://github.com/patrickjuchli/basic-ftp) | `5.2.0` | `5.3.1` | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `5.0.5` | `5.0.6` | | [fast-uri](https://github.com/fastify/fast-uri) | `3.1.0` | `3.1.2` | | [fast-xml-builder](https://github.com/NaturalIntelligence/fast-xml-builder) | `1.1.4` | `1.2.0` | | [hono](https://github.com/honojs/hono) | `4.12.9` | `removed` | | [openclaw](https://github.com/openclaw/openclaw) | `2026.4.1` | `2026.6.1` | Bumps the npm_and_yarn group with 8 updates in the /plugins/openclaw-mcp-server directory: | Package | From | To | | --- | --- | --- | | [@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript) | `0.80.0` | `0.100.1` | | [axios](https://github.com/axios/axios) | `1.14.0` | `1.17.0` | | [basic-ftp](https://github.com/patrickjuchli/basic-ftp) | `5.2.0` | `5.3.1` | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `5.0.5` | `5.0.6` | | [fast-uri](https://github.com/fastify/fast-uri) | `3.1.0` | `3.1.2` | | [fast-xml-builder](https://github.com/NaturalIntelligence/fast-xml-builder) | `1.1.4` | `1.2.0` | | [hono](https://github.com/honojs/hono) | `4.12.9` | `removed` | | [openclaw](https://github.com/openclaw/openclaw) | `2026.3.28` | `2026.6.1` | Bumps the npm_and_yarn group with 8 updates in the /plugins/openclaw-skill-extensions directory: | Package | From | To | | --- | --- | --- | | [@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript) | `0.81.0` | `0.100.1` | | [axios](https://github.com/axios/axios) | `1.14.0` | `1.17.0` | | [basic-ftp](https://github.com/patrickjuchli/basic-ftp) | `5.2.0` | `5.3.1` | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `5.0.5` | `5.0.6` | | [fast-uri](https://github.com/fastify/fast-uri) | `3.1.0` | `3.1.2` | | [fast-xml-builder](https://github.com/NaturalIntelligence/fast-xml-builder) | `1.1.4` | `1.2.0` | | [hono](https://github.com/honojs/hono) | `4.12.9` | `removed` | | [openclaw](https://github.com/openclaw/openclaw) | `2026.4.1` | `2026.6.1` | Updates `vitest` from 1.6.1 to 4.1.8 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vitest-dev/vitest/releases">vitest's releases</a>.</em></p> <blockquote> <h2>v4.1.8</h2> <h3>   🐞 Bug Fixes</h3> <ul> <li><strong>browser</strong>: <ul> <li>Disable client <code>cdp</code> API when <code>allowWrite/allowExec: false</code> [backport to v4]  -  by <a href="https://github.com/hi-ogawa"><code>@​hi-ogawa</code></a> and <strong>Codex</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10450">vitest-dev/vitest#10450</a> <a href="https://github.com/vitest-dev/vitest/commit/e4067b3b1"><!-- raw HTML omitted -->(e4067)<!-- raw HTML omitted --></a></li> <li>Remove orphaned Playwright route when same module is mocked via multiple ids [backport to v4]  -  by <a href="https://github.com/toxik"><code>@​toxik</code></a> and <a href="https://github.com/Zelys-DFKH"><code>@​Zelys-DFKH</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10474">vitest-dev/vitest#10474</a> <a href="https://github.com/vitest-dev/vitest/commit/675b4343f"><!-- raw HTML omitted -->(675b4)<!-- raw HTML omitted --></a></li> </ul> </li> </ul> <h5>    <a href="https://github.com/vitest-dev/vitest/compare/v4.1.7...v4.1.8">View changes on GitHub</a></h5> <h2>v4.1.7</h2> <h3>   🐞 Bug Fixes</h3> <ul> <li><strong>runner</strong>: Limit concurrency per task branch in addition to per leaf callbacks (backport)  -  by <a href="https://github.com/hi-ogawa"><code>@​hi-ogawa</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10384">vitest-dev/vitest#10384</a> <a href="https://github.com/vitest-dev/vitest/commit/4f0f2a1ee"><!-- raw HTML omitted -->(4f0f2)<!-- raw HTML omitted --></a></li> </ul> <h5>    <a href="https://github.com/vitest-dev/vitest/compare/v4.1.6...v4.1.7">View changes on GitHub</a></h5> <h2>v4.1.6</h2> <h3>   🐞 Bug Fixes</h3> <ul> <li><strong>browser</strong>: Provide project reference in <code>ToMatchScreenshotResolvePath</code>  -  by <a href="https://github.com/macarie"><code>@​macarie</code></a> and <a href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10138">vitest-dev/vitest#10138</a> <a href="https://github.com/vitest-dev/vitest/commit/31882607c"><!-- raw HTML omitted -->(31882)<!-- raw HTML omitted --></a></li> <li>Global <code>sequence.concurrent: true</code> with top-level <code>test(..., { concurrent: false })</code> + depreacte <code>sequential</code> test API and options  -  by <a href="https://github.com/hi-ogawa"><code>@​hi-ogawa</code></a>, <strong>Codex</strong> and <a href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10196">vitest-dev/vitest#10196</a> <a href="https://github.com/vitest-dev/vitest/commit/2847dfa2a"><!-- raw HTML omitted -->(2847d)<!-- raw HTML omitted --></a></li> <li><strong>browser</strong>: Simplify orchestrator otel carrier  -  by <a href="https://github.com/hi-ogawa"><code>@​hi-ogawa</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10285">vitest-dev/vitest#10285</a> <a href="https://github.com/vitest-dev/vitest/commit/18af98cee"><!-- raw HTML omitted -->(18af9)<!-- raw HTML omitted --></a></li> </ul> <h3>   🏎 Performance</h3> <ul> <li>Stringify diff objects only once  -  by <a href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10276">vitest-dev/vitest#10276</a> <a href="https://github.com/vitest-dev/vitest/commit/9f7b1528c"><!-- raw HTML omitted -->(9f7b1)<!-- raw HTML omitted --></a></li> </ul> <h5>    <a href="https://github.com/vitest-dev/vitest/compare/v4.1.5...v4.1.6">View changes on GitHub</a></h5> <h2>v4.1.5</h2> <h3>   🚀 Experimental Features</h3> <ul> <li><strong>coverage</strong>: Istanbul to support <code>instrumenter</code> option  -  by <a href="https://github.com/BartWaardenburg"><code>@​BartWaardenburg</code></a> and <a href="https://github.com/AriPerkkio"><code>@​AriPerkkio</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10119">vitest-dev/vitest#10119</a> <a href="https://github.com/vitest-dev/vitest/commit/0e0ff41c7"><!-- raw HTML omitted -->(0e0ff)<!-- raw HTML omitted --></a></li> </ul> <h3>   🐞 Bug Fixes</h3> <ul> <li>--project negation excludes browser instances  -  by <a href="https://github.com/felamaslen"><code>@​felamaslen</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10131">vitest-dev/vitest#10131</a> <a href="https://github.com/vitest-dev/vitest/commit/9423dc084"><!-- raw HTML omitted -->(9423d)<!-- raw HTML omitted --></a></li> <li>Project color label on html reporter  -  by <a href="https://github.com/hi-ogawa"><code>@​hi-ogawa</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10142">vitest-dev/vitest#10142</a> <a href="https://github.com/vitest-dev/vitest/commit/596f73986"><!-- raw HTML omitted -->(596f7)<!-- raw HTML omitted --></a></li> <li>Fix <code>vi.defineHelper</code> called as object method  -  by <a href="https://github.com/hi-ogawa"><code>@​hi-ogawa</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10163">vitest-dev/vitest#10163</a> <a href="https://github.com/vitest-dev/vitest/commit/122c25b5b"><!-- raw HTML omitted -->(122c2)<!-- raw HTML omitted --></a></li> <li>Alias <code>agent</code> reporter to <code>minimal</code>  -  by <a href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10157">vitest-dev/vitest#10157</a> <a href="https://github.com/vitest-dev/vitest/commit/663b99fe3"><!-- raw HTML omitted -->(663b9)<!-- raw HTML omitted --></a></li> <li>Respect diff config options in soft assertions  -  by <a href="https://github.com/Copilot"><code>@​Copilot</code></a>, <strong>sheremet-va</strong> and <a href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/8696">vitest-dev/vitest#8696</a> <a href="https://github.com/vitest-dev/vitest/commit/9787dedad"><!-- raw HTML omitted -->(9787d)<!-- raw HTML omitted --></a></li> <li>Respect diff config options in soft assertions &quot;  -  by <a href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/8696">vitest-dev/vitest#8696</a> <a href="https://github.com/vitest-dev/vitest/commit/7dc6d54fd"><!-- raw HTML omitted -->(7dc6d)<!-- raw HTML omitted --></a></li> <li><strong>ast-collect</strong>: Recognize _<em>vi_import</em> prefix in static test discovery  -  by <a href="https://github.com/Yejneshwar"><code>@​Yejneshwar</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10129">vitest-dev/vitest#10129</a> <a href="https://github.com/vitest-dev/vitest/commit/325463ab2"><!-- raw HTML omitted -->(32546)<!-- raw HTML omitted --></a></li> <li><strong>coverage</strong>: Descriptive error message when reports directory is removed during test run  -  by <a href="https://github.com/DaveT1991"><code>@​DaveT1991</code></a> and <a href="https://github.com/AriPerkkio"><code>@​AriPerkkio</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10117">vitest-dev/vitest#10117</a> <a href="https://github.com/vitest-dev/vitest/commit/1413382e1"><!-- raw HTML omitted -->(14133)<!-- raw HTML omitted --></a></li> <li><strong>snapshot</strong>: Increase default snapshot max output length  -  by <a href="https://github.com/hi-ogawa"><code>@​hi-ogawa</code></a> and <strong>Codex</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10150">vitest-dev/vitest#10150</a> <a href="https://github.com/vitest-dev/vitest/commit/21e66ff63"><!-- raw HTML omitted -->(21e66)<!-- raw HTML omitted --></a></li> <li><strong>ui</strong>: Fix jsx/tsx syntax highlight  -  by <a href="https://github.com/hi-ogawa"><code>@​hi-ogawa</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10152">vitest-dev/vitest#10152</a> <a href="https://github.com/vitest-dev/vitest/commit/f1b1f6c7b"><!-- raw HTML omitted -->(f1b1f)<!-- raw HTML omitted --></a></li> <li><strong>web-worker</strong>: Support MessagePort objects referenced inside postMessage data  -  by <a href="https://github.com/whitphx"><code>@​whitphx</code></a> and <strong>Claude Opus 4.6 (1M context)</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9927">vitest-dev/vitest#9927</a> and <a href="https://redirect.github.com/vitest-dev/vitest/issues/10124">vitest-dev/vitest#10124</a> <a href="https://github.com/vitest-dev/vitest/commit/7ad7d39af"><!-- raw HTML omitted -->(7ad7d)<!-- raw HTML omitted --></a></li> <li><strong>api</strong>: Make test-specification options writable  -  by <a href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10154">vitest-dev/vitest#10154</a> <a href="https://github.com/vitest-dev/vitest/commit/6abd557b7"><!-- raw HTML omitted -->(6abd5)<!-- raw HTML omitted --></a></li> </ul> <h5>    <a href="https://github.com/vitest-dev/vitest/compare/v4.1.4...v4.1.5">View changes on GitHub</a></h5> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vitest-dev/vitest/commit/e61f2dd2a0ba0a266c1c5e0334aad3799fee527f"><code>e61f2dd</code></a> chore: release v4.1.8</li> <li><a href="https://github.com/vitest-dev/vitest/commit/e4067b3b150005fd42cf75f994300119245806b9"><code>e4067b3</code></a> fix(browser): disable client <code>cdp</code> API when <code>allowWrite/allowExec: false</code> [ba...</li> <li><a href="https://github.com/vitest-dev/vitest/commit/a09d47236e19fd3151351080c667036ca6164dc4"><code>a09d472</code></a> chore: release v4.1.7</li> <li><a href="https://github.com/vitest-dev/vitest/commit/a8fd24c1cad2320b19fcc651413c7d928423bdc1"><code>a8fd24c</code></a> chore: release v4.1.6</li> <li><a href="https://github.com/vitest-dev/vitest/commit/18af98cee1830604d57f6a02bf28f8067cdffc06"><code>18af98c</code></a> fix(browser): simplify orchestrator otel carrier (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/10285">#10285</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/31882607cc67c7bf52ead13a606321ffdb06a857"><code>3188260</code></a> feat(browser): provide project reference in <code>ToMatchScreenshotResolvePath</code> (#...</li> <li><a href="https://github.com/vitest-dev/vitest/commit/e399846850fedf10b8228cbe46a419628998acd9"><code>e399846</code></a> chore: release v4.1.5</li> <li><a href="https://github.com/vitest-dev/vitest/commit/7dc6d54fd9dda0fe6fee2fb6451d0611a9ecb6e7"><code>7dc6d54</code></a> Revert &quot;fix: respect diff config options in soft assertions (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/8696">#8696</a>)&quot;</li> <li><a href="https://github.com/vitest-dev/vitest/commit/9787dedade9896a6d3eeed7739177d6c583a68a7"><code>9787ded</code></a> fix: respect diff config options in soft assertions (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/8696">#8696</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/325463ab292c45c3ef27aa21ec7da380c307052c"><code>325463a</code></a> fix(ast-collect): recognize _<em>vi_import</em> prefix in static test discovery (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/10">#10</a>...</li> <li>Additional commits viewable in <a href="https://github.com/vitest-dev/vitest/commits/v4.1.8/packages/vitest">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for vitest since your current version.</p> </details> <br /> Updates `@anthropic-ai/sdk` from 0.80.0 to 0.100.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/anthropics/anthropic-sdk-typescript/releases">@​anthropic-ai/sdk's releases</a>.</em></p> <blockquote> <h2>sdk: v0.100.1</h2> <h2>0.100.1 (2026-05-29)</h2> <p>Full Changelog: <a href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.100.0...sdk-v0.100.1">sdk-v0.100.0...sdk-v0.100.1</a></p> <h3>Bug Fixes</h3> <ul> <li><strong>streaming:</strong> carry encrypted_content on beta compaction blocks (<a href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/1025">#1025</a>) (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/eccddf3ed28645bceed2f3b6eb7826466377f1e8">eccddf3</a>)</li> </ul> <h3>Chores</h3> <ul> <li><strong>client:</strong> update lockfiles to have proper dependencies on standardwebhooks (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/5e9b5237e53aefda65637bd11eb0d07f50bbc952">5e9b523</a>)</li> </ul> <h2>sdk: v0.100.0</h2> <h2>0.100.0 (2026-05-28)</h2> <p>Full Changelog: <a href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.99.0...sdk-v0.100.0">sdk-v0.99.0...sdk-v0.100.0</a></p> <h3>Features</h3> <ul> <li><strong>api:</strong> Add support for claude-opus-4-8, mid-conversation system blocks, and usage.output_tokens_details (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/bb0bf278ea0afdf383b6ea711cadf3ab788ea84a">bb0bf27</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>replace literal newlines (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/66ba1421737231e50bcef295b4437ce60cc90be2">66ba142</a>)</li> </ul> <h2>sdk: v0.99.0</h2> <h2>0.99.0 (2026-05-27)</h2> <p>Full Changelog: <a href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.98.1...sdk-v0.99.0">sdk-v0.98.1...sdk-v0.99.0</a></p> <h3>Features</h3> <ul> <li>support custom file size caps (<a href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/1029">#1029</a>) (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/814cd4c6b5b01e9640d52738d87fa61fc62991e7">814cd4c</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li><strong>streaming:</strong> carry stop_details through message_delta accumulation (<a href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/1027">#1027</a>) (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/198bc277fdfccabe5e9f8a7723a2aa191b46af33">198bc27</a>)</li> </ul> <h2>sdk: v0.98.1</h2> <h2>0.98.1 (2026-05-26)</h2> <p>Full Changelog: <a href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.98.0...sdk-v0.98.1">sdk-v0.98.0...sdk-v0.98.1</a></p> <h3>Bug Fixes</h3> <ul> <li><strong>client:</strong> preserve directory prefix in skills.versions.create uploads (<a href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/1024">#1024</a>) (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/abbcd6a47d84bc6efcf259f0f803158847f255cf">abbcd6a</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/anthropics/anthropic-sdk-typescript/blob/main/CHANGELOG.md">@​anthropic-ai/sdk's changelog</a>.</em></p> <blockquote> <h2>0.100.1 (2026-05-29)</h2> <p>Full Changelog: <a href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.100.0...sdk-v0.100.1">sdk-v0.100.0...sdk-v0.100.1</a></p> <h3>Bug Fixes</h3> <ul> <li><strong>streaming:</strong> carry encrypted_content on beta compaction blocks (<a href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/1025">#1025</a>) (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/eccddf3ed28645bceed2f3b6eb7826466377f1e8">eccddf3</a>)</li> </ul> <h3>Chores</h3> <ul> <li><strong>client:</strong> update lockfiles to have proper dependencies on standardwebhooks (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/5e9b5237e53aefda65637bd11eb0d07f50bbc952">5e9b523</a>)</li> </ul> <h2>0.100.0 (2026-05-28)</h2> <p>Full Changelog: <a href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.99.0...sdk-v0.100.0">sdk-v0.99.0...sdk-v0.100.0</a></p> <h3>Features</h3> <ul> <li><strong>api:</strong> Add support for claude-opus-4-8, mid-conversation system blocks, and usage.output_tokens_details (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/bb0bf278ea0afdf383b6ea711cadf3ab788ea84a">bb0bf27</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>replace literal newlines (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/66ba1421737231e50bcef295b4437ce60cc90be2">66ba142</a>)</li> </ul> <h2>0.99.0 (2026-05-27)</h2> <p>Full Changelog: <a href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.98.1...sdk-v0.99.0">sdk-v0.98.1...sdk-v0.99.0</a></p> <h3>Features</h3> <ul> <li>support custom file size caps (<a href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/1029">#1029</a>) (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/814cd4c6b5b01e9640d52738d87fa61fc62991e7">814cd4c</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li><strong>streaming:</strong> carry stop_details through message_delta accumulation (<a href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/1027">#1027</a>) (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/198bc277fdfccabe5e9f8a7723a2aa191b46af33">198bc27</a>)</li> </ul> <h2>0.98.1 (2026-05-26)</h2> <p>Full Changelog: <a href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.98.0...sdk-v0.98.1">sdk-v0.98.0...sdk-v0.98.1</a></p> <h3>Bug Fixes</h3> <ul> <li><strong>client:</strong> preserve directory prefix in skills.versions.create uploads (<a href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/1024">#1024</a>) (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/abbcd6a47d84bc6efcf259f0f803158847f255cf">abbcd6a</a>)</li> </ul> <h3>Chores</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/512605fa9b5c703d8b523fe62abed37e47a90d98"><code>512605f</code></a> chore: release main</li> <li><a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/d0148df1881f492caa9709cfca7002de6ad06740"><code>d0148df</code></a> codegen metadata</li> <li><a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/4d836b47ef5a6a54ff066eb0be9a076b60e4002d"><code>4d836b4</code></a> codegen metadata</li> <li><a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/323e350620ededff964b2b6930a6d182e3167521"><code>323e350</code></a> codegen metadata</li> <li><a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/ea36df73efb2439fc82a86f7c3782e8ca5726048"><code>ea36df7</code></a> chore(client): update lockfiles to have proper dependencies on standardwebhooks</li> <li><a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/0ea1922fadab460f103f94fd39b975170cf6ee0a"><code>0ea1922</code></a> codegen metadata</li> <li><a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/991d88f14b7bd92b63dfc902ee5029dfa265273e"><code>991d88f</code></a> fix(streaming): carry encrypted_content on beta compaction blocks (<a href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/1025">#1025</a>)</li> <li><a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/6f97c4d68c67aa15aa96064e6bfdce14c6ca1452"><code>6f97c4d</code></a> chore: release main</li> <li><a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/1fd7ec701aa19bf83a6253b38cda2a9be972a00b"><code>1fd7ec7</code></a> feat(api): Add support for claude-opus-4-8, mid-conversation system blocks, a...</li> <li><a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/f5bfc105efc5fedad786ccf683d5e09532de02fc"><code>f5bfc10</code></a> docs: replace literal newlines</li> <li>Additional commits viewable in <a href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.80.0...sdk-v0.100.1">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for <code>@​anthropic-ai/sdk</code> since your current version.</p> </details> <br /> Updates `axios` from 1.14.0 to 1.17.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/axios/axios/releases">axios's releases</a>.</em></p> <blockquote> <h2>v1.17.0 — June 1, 2026</h2> <p>This release adds Node HTTP zstd decompression, hardens config and release workflows, and fixes authentication, header, proxy, and type-handling regressions.</p> <h2>🔒 Security Fixes</h2> <ul> <li><strong>Config Hardening:</strong> Guarded <code>socketPath</code>, <code>params</code>, and <code>paramsSerializer</code> reads with own-property checks to prevent inherited prototype values from affecting request behavior, including SSRF-sensitive paths. (<strong><a href="https://redirect.github.com/axios/axios/issues/10901">#10901</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10922">#10922</a></strong>)</li> <li><strong>Release Publishing:</strong> Switched the publish workflow to npm staged publishing for safer, auditable package releases with provenance. (<strong><a href="https://redirect.github.com/axios/axios/issues/10926">#10926</a></strong>)</li> </ul> <h2>🚀 New Features</h2> <ul> <li><strong>HTTP Compression:</strong> Added Node HTTP adapter support for zstd response decompression, with <code>transitional.advertiseZstdAcceptEncoding</code> controlling whether <code>zstd</code> is advertised in <code>Accept-Encoding</code>. (<strong><a href="https://redirect.github.com/axios/axios/issues/6792">#6792</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10920">#10920</a></strong>)</li> </ul> <h2>🐛 Bug Fixes</h2> <ul> <li><strong>Authentication Handling:</strong> Restored Basic auth on same-origin Node redirects while continuing to strip credentials cross-origin, and aligned the fetch adapter with HTTP adapter behavior for URL-embedded Basic auth. (<strong><a href="https://redirect.github.com/axios/axios/issues/10929">#10929</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10896">#10896</a></strong>)</li> <li><strong>Proxy TLS:</strong> Preserved user <code>httpsAgent</code> TLS options when tunneling HTTPS requests through HTTP CONNECT proxies. (<strong><a href="https://redirect.github.com/axios/axios/issues/10957">#10957</a></strong>)</li> <li><strong>React Native FormData:</strong> Cleared default <code>Content-Type</code> for React Native <code>FormData</code> so multipart boundaries can be generated correctly. (<strong><a href="https://redirect.github.com/axios/axios/issues/10898">#10898</a></strong>)</li> <li><strong>Headers:</strong> Silently skipped empty or whitespace-only header names instead of throwing, matching parsed-header behavior and avoiding React Native response crashes. (<strong><a href="https://redirect.github.com/axios/axios/issues/10875">#10875</a></strong>)</li> <li><strong>Request Data Merging:</strong> Preserved enumerable symbol keys when cloning plain request data through axios merge logic. (<strong><a href="https://redirect.github.com/axios/axios/issues/10812">#10812</a></strong>)</li> <li><strong>Bundler Compatibility:</strong> Converted <code>resolveConfig</code> from an arrow default export to a named function export to avoid webpack and Babel transform interop failures. (<strong><a href="https://redirect.github.com/axios/axios/issues/10891">#10891</a></strong>)</li> <li><strong>Types:</strong> Corrected <code>AxiosHeaders.toJSON()</code> return types and updated CommonJS <code>isCancel</code> typings to narrow to <code>CanceledError&lt;T&gt;</code>. (<strong><a href="https://redirect.github.com/axios/axios/issues/10956">#10956</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10952">#10952</a></strong>)</li> <li><strong>Build Tooling:</strong> Avoided emitting a null <code>Authorization</code> header from the GitHub build helper when <code>GITHUB_TOKEN</code> is unset. (<strong><a href="https://redirect.github.com/axios/axios/issues/10931">#10931</a></strong>)</li> </ul> <h2>🔧 Maintenance &amp; Chores</h2> <ul> <li><strong>HTTP/2 Internals:</strong> Extracted <code>Http2Sessions</code> into its own helper module and added direct unit coverage for session pooling, timeout, and cleanup behavior. (<strong><a href="https://redirect.github.com/axios/axios/issues/10861">#10861</a></strong>)</li> <li><strong>Package Publishing:</strong> Reduced published package size by switching to a <code>files</code> allowlist and dropping unneeded unminified bundle source maps. (<strong><a href="https://redirect.github.com/axios/axios/issues/10939">#10939</a></strong>)</li> <li><strong>CI and Release Automation:</strong> Added bundle-size reporting, moved reports to the job summary, fixed bundle-size comparison coverage, added Node 26 to the matrix, pinned npm for staged publishing, and prepared the 1.17.0 release. (<strong><a href="https://redirect.github.com/axios/axios/issues/10907">#10907</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10911">#10911</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10916">#10916</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10927">#10927</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10935">#10935</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10983">#10983</a></strong>)</li> <li><strong>Developer Workflow:</strong> Added a dev container and iterated on OpenSpec workflow files before removing them from the release branch. (<strong><a href="https://redirect.github.com/axios/axios/issues/10925">#10925</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10914">#10914</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10958">#10958</a></strong>)</li> <li><strong>Documentation and Policy:</strong> Updated disclosure, contributor, collaboration, threat-model, advanced docs, README badges, release notes, moderator configuration, and project metadata. (<strong><a href="https://redirect.github.com/axios/axios/issues/10890">#10890</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10889">#10889</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10921">#10921</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10945">#10945</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10905">#10905</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10933">#10933</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10915">#10915</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10887">#10887</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10955">#10955</a></strong>)</li> <li><strong>Dependencies:</strong> Bumped Babel tooling, Commitlint, ESLint, Rollup, Globals, Vitest, Playwright, <code>fs-extra</code>, <code>qs</code>, docs dependencies, and GitHub Actions dependencies including <code>actions/dependency-review-action</code> and <code>zizmorcore/zizmor-action</code>. (<strong><a href="https://redirect.github.com/axios/axios/issues/10871">#10871</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10879">#10879</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10918">#10918</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10919">#10919</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10934">#10934</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10947">#10947</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10954">#10954</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10960">#10960</a></strong>)</li> </ul> <h2>🌟 New Contributors</h2> <p>We are thrilled to welcome our new contributors. Thank you for helping improve axios:</p> <ul> <li><strong><a href="https://github.com/BasixKOR"><code>@​BasixKOR</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/6792">#6792</a></strong>)</li> <li><strong><a href="https://github.com/carladams1299-lab"><code>@​carladams1299-lab</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10861">#10861</a></strong>)</li> <li><strong><a href="https://github.com/LaplaceYoung"><code>@​LaplaceYoung</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10812">#10812</a></strong>)</li> <li><strong><a href="https://github.com/JamieMagee"><code>@​JamieMagee</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10939">#10939</a></strong>)</li> <li><strong><a href="https://github.com/RonGamzu"><code>@​RonGamzu</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10905">#10905</a></strong>)</li> <li><strong><a href="https://github.com/sapirbaruch"><code>@​sapirbaruch</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10891">#10891</a></strong>)</li> <li><strong><a href="https://github.com/nezukoagent"><code>@​nezukoagent</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10901">#10901</a></strong>)</li> <li><strong><a href="https://github.com/devareddy05"><code>@​devareddy05</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10929">#10929</a></strong>)</li> <li><strong><a href="https://github.com/Mohammad-Faiz-Cloud-Engineer"><code>@​Mohammad-Faiz-Cloud-Engineer</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10922">#10922</a></strong>)</li> <li><strong><a href="https://github.com/azandabot"><code>@​azandabot</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10931">#10931</a></strong>)</li> <li><strong><a href="https://github.com/niksy"><code>@​niksy</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10896">#10896</a></strong>)</li> </ul> <p><a href="https://github.com/axios/axios/compare/v1.16.1...v1.17.0">Full Changelog</a></p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/axios/axios/blob/v1.x/CHANGELOG.md">axios's changelog</a>.</em></p> <blockquote> <h2>v1.17.0 — June 1, 2026</h2> <p>This release adds Node HTTP zstd decompression, hardens config and release workflows, and fixes authentication, header, proxy, and type-handling regressions.</p> <h2>🔒 Security Fixes</h2> <ul> <li><strong>Config Hardening:</strong> Guarded <code>socketPath</code>, <code>params</code>, and <code>paramsSerializer</code> reads with own-property checks to prevent inherited prototype values from affecting request behavior, including SSRF-sensitive paths. (<strong><a href="https://redirect.github.com/axios/axios/issues/10901">#10901</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10922">#10922</a></strong>)</li> <li><strong>Release Publishing:</strong> Switched the publish workflow to npm staged publishing for safer, auditable package releases with provenance. (<strong><a href="https://redirect.github.com/axios/axios/issues/10926">#10926</a></strong>)</li> </ul> <h2>🚀 New Features</h2> <ul> <li><strong>HTTP Compression:</strong> Added Node HTTP adapter support for zstd response decompression, with <code>transitional.advertiseZstdAcceptEncoding</code> controlling whether <code>zstd</code> is advertised in <code>Accept-Encoding</code>. (<strong><a href="https://redirect.github.com/axios/axios/issues/6792">#6792</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10920">#10920</a></strong>)</li> </ul> <h2>🐛 Bug Fixes</h2> <ul> <li><strong>Authentication Handling:</strong> Restored Basic auth on same-origin Node redirects while continuing to strip credentials cross-origin, and aligned the fetch adapter with HTTP adapter behavior for URL-embedded Basic auth. (<strong><a href="https://redirect.github.com/axios/axios/issues/10929">#10929</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10896">#10896</a></strong>)</li> <li><strong>Proxy TLS:</strong> Preserved user <code>httpsAgent</code> TLS options when tunneling HTTPS requests through HTTP CONNECT proxies. (<strong><a href="https://redirect.github.com/axios/axios/issues/10957">#10957</a></strong>)</li> <li><strong>React Native FormData:</strong> Cleared default <code>Content-Type</code> for React Native <code>FormData</code> so multipart boundaries can be generated correctly. (<strong><a href="https://redirect.github.com/axios/axios/issues/10898">#10898</a></strong>)</li> <li><strong>Headers:</strong> Silently skipped empty or whitespace-only header names instead of throwing, matching parsed-header behavior and avoiding React Native response crashes. (<strong><a href="https://redirect.github.com/axios/axios/issues/10875">#10875</a></strong>)</li> <li><strong>Request Data Merging:</strong> Preserved enumerable symbol keys when cloning plain request data through axios merge logic. (<strong><a href="https://redirect.github.com/axios/axios/issues/10812">#10812</a></strong>)</li> <li><strong>Bundler Compatibility:</strong> Converted <code>resolveConfig</code> from an arrow default export to a named function export to avoid webpack and Babel transform interop failures. (<strong><a href="https://redirect.github.com/axios/axios/issues/10891">#10891</a></strong>)</li> <li><strong>Types:</strong> Corrected <code>AxiosHeaders.toJSON()</code> return types and updated CommonJS <code>isCancel</code> typings to narrow to <code>CanceledError&lt;T&gt;</code>. (<strong><a href="https://redirect.github.com/axios/axios/issues/10956">#10956</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10952">#10952</a></strong>)</li> <li><strong>Build Tooling:</strong> Avoided emitting a null <code>Authorization</code> header from the GitHub build helper when <code>GITHUB_TOKEN</code> is unset. (<strong><a href="https://redirect.github.com/axios/axios/issues/10931">#10931</a></strong>)</li> </ul> <h2>🔧 Maintenance &amp; Chores</h2> <ul> <li><strong>HTTP/2 Internals:</strong> Extracted <code>Http2Sessions</code> into its own helper module and added direct unit coverage for session pooling, timeout, and cleanup behavior. (<strong><a href="https://redirect.github.com/axios/axios/issues/10861">#10861</a></strong>)</li> <li><strong>Package Publishing:</strong> Reduced published package size by switching to a <code>files</code> allowlist and dropping unneeded unminified bundle source maps. (<strong><a href="https://redirect.github.com/axios/axios/issues/10939">#10939</a></strong>)</li> <li><strong>CI and Release Automation:</strong> Added bundle-size reporting, moved reports to the job summary, fixed bundle-size comparison coverage, added Node 26 to the matrix, pinned npm for staged publishing, and prepared the 1.17.0 release. (<strong><a href="https://redirect.github.com/axios/axios/issues/10907">#10907</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10911">#10911</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10916">#10916</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10927">#10927</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10935">#10935</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10983">#10983</a></strong>)</li> <li><strong>Developer Workflow:</strong> Added a dev container and iterated on OpenSpec workflow files before removing them from the release branch. (<strong><a href="https://redirect.github.com/axios/axios/issues/10925">#10925</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10914">#10914</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10958">#10958</a></strong>)</li> <li><strong>Documentation and Policy:</strong> Updated disclosure, contributor, collaboration, threat-model, advanced docs, README badges, release notes, moderator configuration, and project metadata. (<strong><a href="https://redirect.github.com/axios/axios/issues/10890">#10890</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10889">#10889</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10921">#10921</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10945">#10945</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10905">#10905</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10933">#10933</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10915">#10915</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10887">#10887</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10955">#10955</a></strong>)</li> <li><strong>Dependencies:</strong> Bumped Babel tooling, Commitlint, ESLint, Rollup, Globals, Vitest, Playwright, <code>fs-extra</code>, <code>qs</code>, docs dependencies, and GitHub Actions dependencies including <code>actions/dependency-review-action</code> and <code>zizmorcore/zizmor-action</code>. (<strong><a href="https://redirect.github.com/axios/axios/issues/10871">#10871</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10879">#10879</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10918">#10918</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10919">#10919</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10934">#10934</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10947">#10947</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10954">#10954</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10960">#10960</a></strong>)</li> </ul> <h2>🌟 New Contributors</h2> <p>We are thrilled to welcome our new contributors. Thank you for helping improve axios:</p> <ul> <li><strong><a href="https://github.com/BasixKOR"><code>@​BasixKOR</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/6792">#6792</a></strong>)</li> <li><strong><a href="https://github.com/carladams1299-lab"><code>@​carladams1299-lab</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10861">#10861</a></strong>)</li> <li><strong><a href="https://github.com/LaplaceYoung"><code>@​LaplaceYoung</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10812">#10812</a></strong>)</li> <li><strong><a href="https://github.com/JamieMagee"><code>@​JamieMagee</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10939">#10939</a></strong>)</li> <li><strong><a href="https://github.com/RonGamzu"><code>@​RonGamzu</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10905">#10905</a></strong>)</li> <li><strong><a href="https://github.com/sapirbaruch"><code>@​sapirbaruch</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10891">#10891</a></strong>)</li> <li><strong><a href="https://github.com/nezukoagent"><code>@​nezukoagent</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10901">#10901</a></strong>)</li> <li><strong><a href="https://github.com/devareddy05"><code>@​devareddy05</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10929">#10929</a></strong>)</li> <li><strong><a href="https://github.com/Mohammad-Faiz-Cloud-Engineer"><code>@​Mohammad-Faiz-Cloud-Engineer</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10922">#10922</a></strong>)</li> <li><strong><a href="https://github.com/azandabot"><code>@​azandabot</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10931">#10931</a></strong>)</li> <li><strong><a href="https://github.com/niksy"><code>@​niksy</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10896">#10896</a></strong>)</li> </ul> <p><a href="https://github.com/axios/axios/compare/v1.16.1...v1.17.0">Full Changelog</a></p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/axios/axios/commit/4306df21e84332fc576e98c2de549347c06bfb76"><code>4306df2</code></a> chore: add fun 88 sponsorship</li> <li><a href="https://github.com/axios/axios/commit/931cc8f0106db4c9885403f85364b9e09ae1f6dc"><code>931cc8f</code></a> chore(release): prepare release 1.17.0 (<a href="https://redirect.github.com/axios/axios/issues/10983">#10983</a>)</li> <li><a href="https://github.com/axios/axios/commit/38ba1b3d2b0aa5ada0463a37a548feb83a84dfa1"><code>38ba1b3</code></a> fix(fetch): support basic auth from URL (<a href="https://redirect.github.com/axios/axios/issues/10896">#10896</a>)</li> <li><a href="https://github.com/axios/axios/commit/32e2515f1e09b649723e4acd89d920df13eee77e"><code>32e2515</code></a> fix: replace ternary side effect in script (<a href="https://redirect.github.com/axios/axios/issues/10931">#10931</a>)</li> <li><a href="https://github.com/axios/axios/commit/030e7223831b0f562af3eb7501b24242c8a4c5ba"><code>030e722</code></a> chore(deps): bump axios from 1.15.2 to 1.16.1 in /docs (<a href="https://redirect.github.com/axios/axios/issues/10960">#10960</a>)</li> <li><a href="https://github.com/axios/axios/commit/ec63164ac6b7a1fcd6b742a8628d3fffe23ce001"><code>ec63164</code></a> chore: remove openspec (<a href="https://redirect.github.com/axios/axios/issues/10958">#10958</a>)</li> <li><a href="https://github.com/axios/axios/commit/3dec28f94ce29d396d5f2d9718805b47428dc7ab"><code>3dec28f</code></a> fix(http): preserve TLS options for proxy tunnels (<a href="https://redirect.github.com/axios/axios/issues/10957">#10957</a>)</li> <li><a href="https://github.com/axios/axios/commit/a2390a5c059342bcac2a5297728181dd9939f562"><code>a2390a5</code></a> fix: correct isCancel type to narrow to CanceledError&lt;T&gt; (<a href="https://redirect.github.com/axios/axios/issues/10952">#10952</a>)</li> <li><a href="https://github.com/axios/axios/commit/fa01b9255d71e72599826428bc6c60f34994c6ce"><code>fa01b92</code></a> chore(deps-dev): bump tmp from 0.2.5 to 0.2.7 in /docs (<a href="https://redirect.github.com/axios/axios/issues/10954">#10954</a>)</li> <li><a href="https://github.com/axios/axios/commit/2d2314a1ac29ce6723eb53e130b4a36617fd201c"><code>2d2314a</code></a> fix: AxiosHeaders <code>toJSON()</code> return types (<a href="https://redirect.github.com/axios/axios/issues/10956">#10956</a>)</li> <li>Additional commits viewable in <a href="https://github.com/axios/axios/compare/v1.14.0...v1.17.0">compare view</a></li> </ul> </details> <br /> Updates `basic-ftp` from 5.2.0 to 5.3.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/patrickjuchli/basic-ftp/releases">basic-ftp's releases</a>.</em></p> <blockquote> <h2>5.3.1</h2> <ul> <li>Fixed: Protect against unbounded control response, fixes <a href="https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-rpmf-866q-6p89">https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-rpmf-866q-6p89</a>.</li> </ul> <h2>5.3.0</h2> <ul> <li>Changed: Introduced an upper bound for total bytes of directory listing, fixes <a href="https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-rp42-5vxx-qpwr">https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-rp42-5vxx-qpwr</a>.</li> <li>Added: Option to increase the upper bound for total bytes of directory listing in Client constructor.</li> </ul> <h2>5.2.2</h2> <ul> <li>Fixed: Improve control character rejection, fixes <a href="https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-6v7q-wjvx-w8wg">https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-6v7q-wjvx-w8wg</a>.</li> </ul> <h2>5.2.1</h2> <ul> <li>Fixed: Reject control character injection attempts using paths. See <a href="https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-chqc-8p9q-pq6q">https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-chqc-8p9q-pq6q</a>.</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/patrickjuchli/basic-ftp/blob/master/CHANGELOG.md">basic-ftp's changelog</a>.</em></p> <blockquote> <h2>5.3.1</h2> <ul> <li>Fixed: Protect against unbounded control response, fixes <a href="https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-rpmf-866q-6p89">https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-rpmf-866q-6p89</a>.</li> </ul> <h2>5.3.0</h2> <ul> <li>Changed: Introduced an upper bound for total bytes of directory listing, fixes <a href="https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-rp42-5vxx-qpwr">https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-rp42-5vxx-qpwr</a>.</li> <li>Added: Option to increase the upper bound for total bytes of directory listing in Client constructor.</li> </ul> <h2>5.2.2</h2> <ul> <li>Fixed: Improve control character rejection, fixes <a href="https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-6v7q-wjvx-w8wg">https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-6v7q-wjvx-w8wg</a>.</li> </ul> <h2>5.2.1</h2> <ul> <li>Fixed: Reject control character injection attempts using paths. See <a href="https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-chqc-8p9q-pq6q">https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-chqc-8p9q-pq6q</a>.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/patrickjuchli/basic-ftp/commit/980371bb6057d78d479b5cfc18683392abd2c45f"><code>980371b</code></a> Guard against unbounded control response</li> <li><a href="https://github.com/patrickjuchli/basic-ftp/commit/50827c73ca6c1d786c97276e47be8a33d0f2277d"><code>50827c7</code></a> Adjust changelog to match release notes</li> <li><a href="https://github.com/patrickjuchli/basic-ftp/commit/c9378a8ff73b96e89f17525266d648ce495286a6"><code>c9378a8</code></a> Fix test</li> <li><a href="https://github.com/patrickjuchli/basic-ftp/commit/22abe4356782f499d97418f0a7a2c3bb02db72b7"><code>22abe43</code></a> Update Github Actions</li> <li><a href="https://github.com/patrickjuchli/basic-ftp/commit/0feaaec3d4394bb3470edd006df933d2b6e64689"><code>0feaaec</code></a> Fix test</li> <li><a href="https://github.com/patrickjuchli/basic-ftp/commit/6629d7d7abe9169543a8ff60a6dc32e6fe7cf91c"><code>6629d7d</code></a> Improve error message</li> <li><a href="https://github.com/patrickjuchli/basic-ftp/commit/9c3bf4f893470cd2418b54862eb9b609efc3d335"><code>9c3bf4f</code></a> Set higher default value for max size of directory listing</li> <li><a href="https://github.com/patrickjuchli/basic-ftp/commit/acd3942c81ac27caf998b0ed13f3ce85c0fc6320"><code>acd3942</code></a> Bump version</li> <li><a href="https://github.com/patrickjuchli/basic-ftp/commit/130442932b1ef27a550c915f231c07eae01e665a"><code>1304429</code></a> Offer maxListingBytes as an option</li> <li><a href="https://github.com/patrickjuchli/basic-ftp/commit/5cb5367e86d8a2991224fb2b82e4933d27c07904"><code>5cb5367</code></a> Add bounded StringWriter</li> <li>Additional commits viewable in <a href="https://github.com/patrickjuchli/basic-ftp/compare/v5.2.0...v5.3.1">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~patrickjuchli">patrickjuchli</a>, a new releaser for basic-ftp since your current version.</p> </details> <details> <summary>Install script changes</summary> <p>This version adds <code>prepare</code> script that runs during installation. Review the package contents before updating.</p> </details> <br /> Updates `brace-expansion` from 5.0.5 to 5.0.6 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/juliangruber/brace-expansion/commit/46317b5d8779c151d24f65c9c139cd076f91a1c3"><code>46317b5</code></a> 5.0.6</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5"><code>c0b095b</code></a> Merge commit from fork</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/ec5602085a81ca7c954f6780c6a3aef0b1e200cf"><code>ec56020</code></a> Bump picomatch from 4.0.3 to 4.0.4 (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/93">#93</a>)</li> <li>See full diff in <a href="https://github.com/juliangruber/brace-expansion/compare/v5.0.5...v5.0.6">compare view</a></li> </ul> </details> <br /> Updates `fast-uri` from 3.1.0 to 3.1.2 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/fastify/fast-uri/releases">fast-uri's releases</a>.</em></p> <blockquote> <h2>v3.1.2</h2> <h2>⚠️ Security Release</h2> <ul> <li>Fix for <a href="https://github.com/fastify/fast-uri/security/advisories/GHSA-v39h-62p7-jpjc">https://github.com/fastify/fast-uri/security/advisories/GHSA-v39h-62p7-jpjc</a></li> </ul> <h2>What's Changed</h2> <ul> <li>Handle malformed fragment decoding as a parse error by <a href="https://github.com/mcollina"><code>@​mcollina</code></a> in <a href="https://redirect.github.com/fastify/fast-uri/pull/171">fastify/fast-uri#171</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/fastify/fast-uri/compare/v3.1.1...v3.1.2">https://github.com/fastify/fast-uri/compare/v3.1.1...v3.1.2</a></p> <h2>v3.1.1</h2> <h2>⚠️ Security Release</h2> <ul> <li>Fix for <a href="https://github.com/fastify/fast-uri/security/advisories/GHSA-q3j6-qgpj-74h6">https://github.com/fastify/fast-uri/security/advisories/GHSA-q3j6-qgpj-74h6</a></li> </ul> <h2>What's Changed</h2> <ul> <li>build(deps-dev): bump tsd from 0.32.0 to 0.33.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/fastify/fast-uri/pull/148">fastify/fast-uri#148</a></li> <li>build(deps): bump actions/checkout from 4 to 5 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/fastify/fast-uri/pull/149">fastify/fast-uri#149</a></li> <li>chore(.npmrc): ignore scripts by <a href="https://github.com/Fdawgs"><code>@​Fdawgs</code></a> in <a href="https://redirect.github.com/fastify/fast-uri/pull/150">fastify/fast-uri#150</a></li> <li>build(deps-dev): remove <code>@​fastify/pre-commit</code> by <a href="https://github.com/Fdawgs"><code>@​Fdawgs</code></a> in <a href="https://redirect.github.com/fastify/fast-uri/pull/151">fastify/fast-uri#151</a></li> <li>build(deps): bump actions/setup-node from 4 to 5 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/fastify/fast-uri/pull/152">fastify/fast-uri#152</a></li> <li>ci(ci): add concurrency config by <a href="https://github.com/Fdawgs"><code>@​Fdawgs</code></a> in <a href="https://redirect.github.com/fastify/fast-uri/pull/153">fastify/fast-uri#153</a></li> <li>build(deps): bump actions/setup-node from 5 to 6 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/fastify/fast-uri/pull/154">fastify/fast-uri#154</a></li> <li>build(deps): bump actions/checkout from 5 to 6 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/fastify/fast-uri/pull/156">fastify/fast-uri#156</a></li> <li>chore(license): standardise license notice by <a href="https://github.com/Fdawgs"><code>@​Fdawgs</code></a> in <a href="https://redirect.github.com/fastify/fast-uri/pull/159">fastify/fast-uri#159</a></li> <li>style: remove trailing whitespace by <a href="https://github.com/Fdawgs"><code>@​Fdawgs</code></a> in <a href="https://redirect.github.com/fastify/fast-uri/pull/161">fastify/fast-uri#161</a></li> <li>ci: remove unused github files by <a href="https://github.com/Tony133"><code>@​Tony133</code></a> in <a href="https://redirect.github.com/fastify/fast-uri/pull/162">fastify/fast-uri#162</a></li> <li>chore: update readme by <a href="https://github.com/Tony133"><code>@​Tony133</code></a> in <a href="https://redirect.github.com/fastify/fast-uri/pull/164">fastify/fast-uri#164</a></li> <li>build(deps): bump fastify/workflows/.github/workflows/plugins-ci-package-manager.yml from 5 to 6 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/fastify/fast-uri/pull/165">fastify/fast-uri#165</a></li> <li>build(deps): bump fastify/workflows/.github/workflows/plugins-ci.yml from 5 to 6 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/fastify/fast-uri/pull/166">fastify/fast-uri#166</a></li> <li>build(deps-dev): bump neostandard from 0.12.2 to 0.13.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/fastify/fast-uri/pull/167">fastify/fast-uri#167</a></li> <li>ci: add lock-threads workflow by <a href="https://github.com/Fdawgs"><code>@​Fdawgs</code></a> in <a href="https://redirect.github.com/fastify/fast-uri/pull/169">fastify/fast-uri#169</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/Tony133"><code>@​Tony133</code></a> made their first contribution in <a href="https://redirect.github.com/fastify/fast-uri/pull/162">fastify/fast-uri#162</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/fastify/fast-uri/compare/v3.1.0...v3.1.1">https://github.com/fastify/fast-uri/compare/v3.1.0...v3.1.1</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/fastify/fast-uri/commit/919dd8ea7689fcc220d0d9b71307f5095e723ef9"><code>919dd8e</code></a> Bumped v3.1.2</li> <li><a href="https://github.com/fastify/fast-uri/commit/c65ba573714af6b8e19e481d9444c27bc4355d07"><code>c65ba57</code></a> fixup: linting</li> <li><a href="https://github.com/fastify/fast-uri/commit/6c86c17c3d76fb93aa3700ec6c0fa00faeb97293"><code>6c86c17</code></a> Merge commit from fork</li> <li><a href="https://github.com/fastify/fast-uri/commit/a95158ad308df4d92bbde4eba699ce5165e9f796"><code>a95158a</code></a> Handle malformed fragment decoding without throwing (<a href="https://redirect.github.com/fastify/fast-uri/issues/171">#171</a>)</li> <li><a href="https://github.com/fastify/fast-uri/commit/cea547c91c6aae610041b17b75792ca4aa035a6d"><code>cea547c</code></a> Bumped v3.1.1</li> <li><a href="https://github.com/fastify/fast-uri/commit/876ce79b662c3e5015e4e7dffe6f37752ad34f35"><code>876ce79</code></a> Merge commit from fork</li> <li><a href="https://github.com/fastify/fast-uri/commit/dcdf690b71a7bb3a19887ada65a9ab160d83bcc0"><code>dcdf690</code></a> ci: add lock-threads workflow (<a href="https://redirect.github.com/fastify/fast-uri/issues/169">#169</a>)</li> <li><a href="https://github.com/fastify/fast-uri/commit/c860e6589b1ac346f66e114b4eadb9613768108c"><code>c860e65</code></a> build(deps-dev): bump neostandard from 0.12.2 to 0.13.0 (<a href="https://redirect.github.com/fastify/fast-uri/issues/167">#167</a>)</li> <li><a href="https://github.com/fastify/fast-uri/commit/9b4c6dc82fde0ca44e674403ece9185d85bb6d5f"><code>9b4c6dc</code></a> build(deps): bump fastify/workflows/.github/workflows/plugins-ci.yml (<a href="https://redirect.github.com/fastify/fast-uri/issues/166">#166</a>)</li> <li><a href="https://github.com/fastify/fast-uri/commit/85d09a9f7aa76b32c2bb005a90a71e144c361d24"><code>85d09a9</code></a> build(deps): bump fastify/workflows/.github/workflows/plugins-ci-package-mana...</li> <li>Additional commits viewable in <a href="https://github.com/fastify/fast-uri/compare/v3.1.0...v3.1.2">compare view</a></li> </ul> </details> <br /> Updates `fast-xml-builder` from 1.1.4 to 1.2.0 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/NaturalIntelligence/fast-xml-builder/blob/main/CHANGELOG.md">fast-xml-builder's changelog</a>.</em></p> <blockquote> <p><strong>1.2.0</strong> (2026-05-08)</p> <ul> <li>Add support for <code>sanitizeName</code> option</li> <li>Support xml-naming for validating and sanitizing tag and attribute names</li> </ul> <p><strong>1.1.9</strong> (2026-05-06)</p> <ul> <li>fix: format output for preserve order when indent by is set to empty string</li> </ul> <p><strong>1.1.8</strong> (2026-05-05)</p> <ul> <li>fix: skip text property for PI tags</li> <li>improve typings</li> </ul> <p><strong>1.1.7</strong> (2026--05-04)</p> <ul> <li>fix security issues when attribute value contains quotes</li> </ul> <p><strong>1.1.6</strong> (2026--05-04)</p> <ul> <li>fix security issues related to comment</li> <li>skip comment with null value</li> </ul> <p><strong>1.1.5</strong> (2026-04-17)</p> <ul> <li>fix security issues related to comment and cdata</li> </ul> <p><strong>1.1.4</strong> (2026-03-16)</p> <ul> <li>support maxNestedTags option</li> </ul> <p><strong>1.1.3</strong> (2026-03-13)</p> <ul> <li>declare Matcher &amp; Expression as unknown so user is not forced to install path-expression-matcher</li> </ul> <p><strong>1.1.2</strong> (2026-03-11)</p> <ul> <li>fix typings</li> </ul> <p><strong>1.1.1</strong> (2026-03-11)</p> <ul> <li>upgrade path-expression-matcher to 1.1.3</li> </ul> <p><strong>1.1.0</strong> (2026-03-10)</p> <ul> <li>Integrate <a href="https://github.com/NaturalIntelligence/path-expression-matcher">path-expression-matcher</a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/NaturalIntelligence/fast-xml-builder/commit/a9a905b316176ef9a97bdf5450e60efbf0341f25"><code>a9a905b</code></a> for release</li> <li><a href="https://github.com/NaturalIntelligence/fast-xml-builder/commit/42680e8d730c48082268823fd285e10127ddba21"><code>42680e8</code></a> support name sanitization</li> <li><a href="https://github.com/NaturalIntelligence/fast-xml-builder/commit/8b00185bf6be67981ffc40e06c18acbbbe908779"><code>8b00185</code></a> release info</li> <li><a href="https://github.com/NaturalIntelligence/fast-xml-builder/commit/8a08f173d7b9c9a82599fe7de279ca7e12c3ad6b"><code>8a08f17</code></a> allow indentation to be empty string</li> <li><a href="https://github.com/NaturalIntelligence/fast-xml-builder/commit/7fc5decb9613afbd5d03747b1a0f11e0916e34ef"><code>7fc5dec</code></a> update docs</li> <li><a href="https://github.com/NaturalIntelligence/fast-xml-builder/commit/c241b6a8ed1863e5f518490ec1fcc38b13f2c370"><code>c241b6a</code></a> improve documentation</li> <li><a href="https://github.com/NaturalIntelligence/fast-xml-builder/commit/15d5668b53777400c8d80b6e21029c1a70888c78"><code>15d5668</code></a> update for release</li> <li><a href="https://github.com/NaturalIntelligence/fast-xml-builder/commit/98774853a696a1aee4dca830dd3eee2759676bd2"><code>9877485</code></a> fix: skip text property for PI tags</li> <li><a href="https://github.com/NaturalIntelligence/fast-xml-builder/commit/311a2213a817cf31558bea7c0e0807b0d4441814"><code>311a221</code></a> fix <a href="https://redirect.github.com/NaturalIntelligence/fast-xml-builder/issues/5">#5</a> typing import issues</li> <li><a href="https://github.com/NaturalIntelligence/fast-xml-builder/commit/e8fc5b15d9d54b559781961f066de82a55aabcdd"><code>e8fc5b1</code></a> update for releast</li> <li>Additional commits viewable in <a href="https://github.com/NaturalIntelligence/fast-xml-builder/compare/v1.1.4...v1.2.0">compare view</a></li> </ul> </details> <br /> Removes `hono` Updates `openclaw` from 2026.3.28 to 2026.6.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/openclaw/openclaw/releases">openclaw's releases</a>.</em></p> <blockquote> <h2>openclaw 2026.6.1</h2> <h3>Highlights</h3> <ul> <li>Agents and CLI-backed runtimes recover more cleanly from interrupted tool calls, stale session bin... _Description has been truncated_ --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
yindo added the pull-request label 2026-06-05 14:30:23 -04:00
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Heretek-AI/heretek-openclaw-plugins#3