Oneseco Media GITHUB

[Oneseco-Media/rsshub]

Bump youtubei.js from 18.0.0 to 18.3.0

By dependabot[bot]

Assigned to

Bumps youtubei.js from 18.0.0 to 18.3.0.

Release notes

Sourced from youtubei.js's releases.

v18.3.0

18.3.0 (2026-10-23)

Features

History: Implement watch history controls (#1304) (873d173)

LockupView: Add course as possible content_type (#1313) (5de9e5e)

PlaylistManager: add support for privacy_status and description when creating a playlist (#1310) (1c5d1ad)

ThumbnailOverlayTimeStatus: Add icon_type (#1314) (04cd4db)

v18.2.0

18.2.0 (2026-10-18)

Features

CompositeVideoPrimaryInfo: Add composite_source_video_primary_info_renderers prop (7be569a)

History: Add support for searching watch history (#1290) (3276daa)

LockupView: Add duration getter (#1303) (447c613)

LockupView: Add styling (#1285) (22103e8)

MediaInfo: Expose publish and upload dates in basic_info (#1274) (6faab8e)

parser: Add CommentImageAttachmentView (#1299) (c01873d)

parser: Add CourseProgressView class (79f7934), closes #917

parser: Add LinearLayoutView class (bdb0797)

parser: Add MenuCustomIconItem class (50883a8), closes #1242

parser: Add PlayerInterstitial and InterstitialView class (#1269) (bad89d2)

parser: Add VideoDescriptionGamingSection class (16f2ed9), closes #1118

parser: Add infocards section nodes (8676d40), closes #730

ShortsLockupView: Add thumbnail_view_model (#1283) (c717f43)

Bug Fixes

Handle missing session config and import Text in ToggleFormField (#1276) (710900a)

LockupMetadataView: Handle missing titles (#1278) (f268ba1)

LockupView: duration getter not working with very long videos (#1306) (cb4a44e)

LockupView: duration parsing large values incorrectly (#1308) (b95ee26)

LockupView: Parser error when content_type is undefined (#1297) (ae4e655)

parser: Add ToggleableListItemView class (#1282) (02c5c8d)

parser: Improve storyboard data parsing (32323cd), closes #671

StructuredDescriptionContent: Add ItemSection type to items (fb801f9)

StructuredDescriptionContent: Add VideoTitleHeaderView type to items (20e3251)

Tab: Add Message type to content (3048496)

Video: is_live getter not working (#1291) (935364f)

v18.1.0

18.1.0 (2026-09-22)

... (truncated)

Changelog

Sourced from youtubei.js's changelog.

18.3.0 (2026-10-23)

Features

History: Implement watch history controls (#1304) (873d173)

LockupView: Add course as possible content_type (#1313) (5de9e5e)

PlaylistManager: add support for privacy_status and description when creating a playlist (#1310) (1c5d1ad)

ThumbnailOverlayTimeStatus: Add icon_type (#1314) (04cd4db)

18.2.0 (2026-10-18)

Features

CompositeVideoPrimaryInfo: Add composite_source_video_primary_info_renderers prop (7be569a)

History: Add support for searching watch history (#1290) (3276daa)

LockupView: Add duration getter (#1303) (447c613)

LockupView: Add styling (#1285) (22103e8)

MediaInfo: Expose publish and upload dates in basic_info (#1274) (6faab8e)

parser: Add CommentImageAttachmentView (#1299) (c01873d)

parser: Add CourseProgressView class (79f7934), closes #917

parser: Add LinearLayoutView class (bdb0797)

parser: Add MenuCustomIconItem class (50883a8), closes #1242

parser: Add PlayerInterstitial and InterstitialView class (#1269) (bad89d2)

parser: Add VideoDescriptionGamingSection class (16f2ed9), closes #1118

parser: Add infocards section nodes (8676d40), closes #730

ShortsLockupView: Add thumbnail_view_model (#1283) (c717f43)

Bug Fixes

Handle missing session config and import Text in ToggleFormField (#1276) (710900a)

LockupMetadataView: Handle missing titles (#1278) (f268ba1)

LockupView: duration getter not working with very long videos (#1306) (cb4a44e)

LockupView: duration parsing large values incorrectly (#1308) (b95ee26)

LockupView: Parser error when content_type is undefined (#1297) (ae4e655)

parser: Add ToggleableListItemView class (#1282) (02c5c8d)

parser: Improve storyboard data parsing (32323cd), closes #671

StructuredDescriptionContent: Add ItemSection type to items (fb801f9)

StructuredDescriptionContent: Add VideoTitleHeaderView type to items (20e3251)

Tab: Add Message type to content (3048496)

Video: is_live getter not working (#1291) (935364f)

18.1.0 (2026-09-22)

Features

Channel: add methods for show tab (#1260) (d252b36)

... (truncated)

Commits

204715b chore(main): release 18.3.0 (#1315)

1c5d1ad feat(PlaylistManager): add support for privacy_status and description whe...

873d173 feat(History): Implement watch history controls (#1304)

fa7741f chore(deps-dev): bump the development-dependencies group with 8 updates (#1311)

04cd4db feat(ThumbnailOverlayTimeStatus): Add icon_type (#1314)

5de9e5e feat(LockupView): Add course as possible content_type (#1313)

c4a7b3f chore(docs): Regen API ref

78375cb chore(main): release 18.2.0 (#1270)

79f7934 feat(parser): Add CourseProgressView class

7be569a feat(CompositeVideoPrimaryInfo): Add `composite_source_video_primary_info_ren...

Additional commits viewable in compare view

[

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• `@dependabot show

Labeled:

October 26, 2026 at 03:25AM

via GitHub https://ift.tt/dUqIXFB

[Oneseco-Media/rsshub]

Bump re2js from 2.8.6 to 2.9.0

By dependabot[bot]

Assigned to

Bumps re2js from 2.8.6 to 2.9.0.

Release notes

Sourced from re2js's releases.

2.9.0

What's Changed

DFA is built on first use + froze Codepoint.CODES by @​le0pard in le0pard/re2js#65

add fuzzer tests by @​le0pard in le0pard/re2js#66

Full Changelog: https://github.com/le0pard/re2js/compare/2.8.8...2.9.0

2.8.8

What's Changed

Bump the actions group with 3 updates by @​dependabot[bot] in le0pard/re2js#61

Bump source-map-js from 1.2.1 to 1.2.2 by @​dependabot[bot] in le0pard/re2js#62

Bump the development group with 4 updates by @​dependabot[bot] in le0pard/re2js#63

DFA now handles \b, \B, ^, $, \A and \z itself, ported from RE2's dfa.cc by @​le0pard in le0pard/re2js#64

Full Changelog: https://github.com/le0pard/re2js/compare/2.8.7...2.8.8

2.8.7

What's Changed

Bump @​vitest/browser from 4.1.9 to 4.1.10 in the npm_and_yarn group across 1 directory by @​dependabot[bot] in le0pard/re2js#50

Bump the npm_and_yarn group across 1 directory with 2 updates by @​dependabot[bot] in le0pard/re2js#51

Migrate runes to Int32Array by @​le0pard in le0pard/re2js#52

Bump postcss from 8.5.15 to 8.5.23 in the npm_and_yarn group across 1 directory by @​dependabot[bot] in le0pard/re2js#53

Bump undici from 6.27.0 to 6.28.0 in the npm_and_yarn group across 1 directory by @​dependabot[bot] in le0pard/re2js#55

Bump nanoid from 3.3.16 to 3.3.18 in the npm_and_yarn group across 1 directory by @​dependabot[bot] in le0pard/re2js#56

Bump undici from 6.28.0 to 6.29.0 in the npm_and_yarn group across 1 directory by @​dependabot[bot] in le0pard/re2js#58

Fix LOOKBEHINDS flag together with any repeated-matching API (matcher().find() in a loop, matchAll(), split(), matcher().replaceAll()) causes quadratic-time by @​le0pard in le0pard/re2js#59

Small security fixes by @​le0pard in le0pard/re2js#60

Full Changelog: https://github.com/le0pard/re2js/compare/2.8.6...2.8.7

Commits

f81527a bump version

1777f80 Merge pull request #66 from le0pard/fuzzer

620f04b add fuzzer worker

c9e23ef finish fuzzer

ed69d4b add fuzzer tests

5344f49 Merge pull request #65 from le0pard/maintainability-fixes

894c602 fix dead end in engine

b4e727a cleanup codebase

dc46069 JS-mode replacement strings now follow the ECMAScript rules

4ea6730 DFA is built on first use + froze Codepoint.CODES

Additional commits viewable in compare view

[

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• `@dependabot show

Labeled:

October 26, 2026 at 03:25AM

via GitHub https://ift.tt/HPYJsAN

[Oneseco-Media/rsshub]

Bump dotenv from 17.4.2 to 18.0.9

By dependabot[bot]

Assigned to

Bumps dotenv from 17.4.2 to 18.0.9.

Changelog

Sourced from dotenv's changelog.

18.0.9 (2026-10-14)

Changed

Permit DOTENV_PATH being empty string with the CLI (#1076)

18.0.8 (2026-10-14)

Changed

Fast parser should strip appended extra quotes (#1073)

Type detail improvement (#1074)

18.0.7 (2026-10-09)

Changed

Treat undefined settings like quiet: true as null rather than falsey (#1070)

CLI should honor DOTENV_QUIET setting in .env file (#1071)

18.0.6 (2026-10-06)

Changed

Use smarter parseBoolean not Boolean() to fix override (#1069)

18.0.5 (2026-09-30)

Changed

Fix missing typescript module declaration (#1068)

Improve performance for large .env files (#1066)

18.0.4 (2026-09-25)

Changed

import dotenv/config should default quiet: true (#1063)

18.0.3 (2026-09-22)

Changed

Patch DOTENV_QUIET setting when inside .env file (#1059)

18.0.2 (2026-09-21)

Changed

Patch additional edge cases for the fast parser (#1056)

... (truncated)

Commits

8d1ab85 18.0.9

59a40ce changelog

88228bd Merge pull request #1076 from Enesuygurs/fix/cli-empty-dotenv-path

bc6ef94 fix(cli): load the default .env when DOTENV_PATH is empty

6d6e6c5 Merge pull request #1075 from kory-kaai/test/fast-parser-branch-coverage

10218f1 test(parse-fast): cover the size-dependent and export-prefix branches

e2fe95e 18.0.8

7aa712a type detail improvement

53405b0 Merge pull request #1074 from himanshu748/codex/fix-dotenv-populate-undefined...

0b4843a changelog

Additional commits viewable in compare view

[

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• `@dependabot show

Labeled:

October 26, 2026 at 03:24AM

via GitHub https://ift.tt/lbjwHp2

[Oneseco-Media/rsshub]

Bump imapflow from 2.0.2 to 2.9.1

By dependabot[bot]

Assigned to

Bumps imapflow from 2.0.2 to 2.9.1.

Changelog

Sourced from imapflow's changelog.

2.9.1 (2026-10-22)

Bug Fixes

update dependencies (bf20e37)

2.9.0 (2026-10-22)

Features

closedByClient tells a close the application asked for from one the server made, and auto-IDLE never waits longer than maxIdleTime (5339c12)

Bug Fixes

logout() marks the close as the application's before the LOGOUT exchange, and closeAfter() is tested (03602d2)

2.8.0 (2026-10-21)

Features

idle({ whenFree: true }) waits for the connection to be free before starting IDLE (791c24c)

2.7.0 (2026-10-21)

Features

expose idlingAtClose so a consumer can tell a session dropped in IDLE (eb5ac6c)

2.6.0 (2026-10-21)

Features

expose mailboxList, context, connectedAt and lastClientWrite on the client (c054bd3)

Bug Fixes

emit the error event at most once per connection (434e6eb)

let idle() wait for a free connection before starting IDLE (4a3d7df)

reject a mailbox lock when the processLocks pass handling it throws (a207cd0)

reject fetch() without a selected mailbox instead of returning nothing (78036b8)

report UIDVALIDITY and HIGHESTMODSEQ changes found by the polling fallback (0f4c306)

require an exact LIST match before treating a failed SELECT mailbox as existing (99a5db0)

start IDLE right away again when idle() is called inside a mailbox lock (018967d)

... (truncated)

Commits

f44b027 Merge pull request #454 from postalsys/release-please--branches--master--comp...

d35b033 chore(master): release 2.9.1 [skip-ci]

bf20e37 fix: update dependencies

fef983f Merge pull request #453 from postalsys/release-please--branches--master--comp...

efcc8e2 chore(master): release 2.9.0 [skip-ci]

03602d2 fix: logout() marks the close as the application's before the LOGOUT exchange...

5339c12 feat: closedByClient tells a close the application asked for from one the ser...

24e5122 refactor: one helper settles the idle({ whenFree }) waiters, on wake and on c...

12d6a0e Merge pull request #452 from postalsys/release-please--branches--master--comp...

bb2a8b8 chore(master): release 2.8.0 [skip-ci]

Additional commits viewable in compare view

[

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• `@dependabot show

Labeled:

October 26, 2026 at 03:23AM

via GitHub https://ift.tt/skF5Jpj

[Oneseco-Media/rsshub]

Bump the opentelemetry group across 1 directory with 6 updates

By dependabot[bot]

Assigned to

Bumps the opentelemetry group with 6 updates in the / directory:

Updates @opentelemetry/api from 1.9.1 to 1.10.0

Release notes

Sourced from @​opentelemetry/api's releases.

api/v1.10.0

1.10.0

:rocket: Features

feat(api): integrate the Logs API into @opentelemetry/api #4862 @​hectorhdzg

feat(api): add imperative context.attach() for setting context across callback boundaries that with() cannot wrap. #6845 @​pichlermarc

attach() returns a Token whose dispose() method restores the previous context. Use token.dispose() to detach.

attach is an optional method on the ContextManager interface; when the active context manager does not implement it, context.attach() logs a warning and returns a no-op token.

feat(api): add AnyValue type (of type unknown) and extend Attributes type values to use AnyValue #6780 @​trentm

This is part of supporting OTEP 4485.

This is a breaking change for SDK implementations, in that they may need to support more attribute types for any APIs that accept Attributes or AnyValue. Implementors should refer to the OTEP 4485 link above for "MUST / SHOULD" requirements for complex attributes handling. See also the attributes-handling utilities provided by @opentelemetry/core to help. For example, cleanSimpleAttributes() can be used to limit user-provided attributes to the set of value types supported in earlier @opentelemetry/api versions.

This change is typically not a breaking change for users of @opentelemetry/api. There is one possible breaking case: If a TypeScript user was using the Attributes type in their own code and using TypeScript Narrowing to reduce an attribute value to an expected type (example here). It is expected that this usage should be rare and, likely, limited to SDK implementations, if at all. (If this impacted your code, please let us know.)

Note for users of attributes: Simple attributes SHOULD be used whenever possible. Instrumentations SHOULD assume that backends do not index individual properties of complex attributes, that querying or aggregating on such properties is inefficient and complicated, and that reporting complex attributes carries higher performance overhead.

:bug: Bug Fixes

fix(api): cap tracestate list-members and total length in the deprecated TraceState.set() so it stays in step with TraceState from @opentelemetry/core #6964 @​Zuhef

fix: resolve the ESM build through the default export condition instead of import, so a resolver that activates neither import nor require still finds an entry point #7132 @​overbalance

:books: Documentation

docs(api): complete @since annotations for the public API #7023 @​nabeelamjadsheikh

Adds the three missing exported-type annotations and the member-level annotations for methods and properties introduced after their enclosing type.

Corrects Attributes, AttributeValue and TracerOptions from 1.3.0 to 1.1.0; all three were already importable in 1.1.0 via wildcard re-export.

:house: Internal

build: migrate the package build from tsc to tsdown, emitting dual CJS/ESM output from a single dist/ directory #6293 @​overbalance

The public entry points are unchanged: @opentelemetry/api and @opentelemetry/api/experimental. This package already declared an exports map, so deep imports such as @opentelemetry/api/build/src/... were rejected before this change and continue to be.

The emitted files moved out of build/src (CJS), build/esm and build/esnext (ESM) into dist/, using .cjs/.mjs extensions with matching .d.cts/.d.mts declarations. The non-standard esnext condition has been dropped in favour of the standard import/require conditions.

perf(api): add getGlobal fast-path #6956 @​legendecas

chore: remove the redundant module field from package.json; bundlers resolve the ESM build through the exports map #7130 @​overbalance

Changelog

Sourced from @​opentelemetry/api's changelog.

1.10.0

:rocket: (Enhancement)

feat(resource): create sync resource with some attributes that resolve asynchronously #3460 @​samimusallam

feat: collect host id for non-cloud environments #3575 @​mwear

feat (api-logs): separate Events API into its own package 3550 @​martinkuba

feat(sdk-metrics): apply binary search in histogram recording #3539 @​legendecas

perf(propagator-jaeger): improve deserializeSpanContext performance #3541 @​doochik

feat: support TraceState in SamplingResult #3530 @​raphael-theriault-swi

feat(sdk-trace-base): add diagnostic logging when spans are dropped #3610 @​neoeinstein

feat: add unit to view instrument selection criteria #3647 @​jlabatut

feat(tracing): expose dropped counts for attributes, events and links on span #3576 @​mohitk05

:bug: (Bug Fix)

fix(core): added falsy check to make otel core work with browser where webpack config had process as false or null #3613 @​ravindra-dyte

fix(instrumentation-http): include query params in http.target #3646 @​kobi-co

:books: (Refine Doc)

chore: update http example #3651 @​JamieDanielson

:house: (Internal)

chore(exporter-jaeger): deprecate jaeger exporter #3585 @​pichlermarc

fix(sdk-metrics): fix flaky LastValueAggregator test by using fake timer #3587 @​pichlermarc

fix(test): fix failing tests by preventing source-map generation #3642 @​pichlermarc

Commits

56e6b1b chore: Release API 1.4.1, SDK 1.10.0, Experimental 0.36.0 (#3654)

ecb5ebe fix: Minor typing issues for web sandbox (#3660)

48ecf22 feat(sdk-trace-base): add dropped attributes and events count on span (#3576)

95bf6fc fix(build): add example/http to ignore list in update-ts-configs (#3657)

3a2ca58 feat: add unit to view instrument selection criteria (#3647)

ebc8575 chore(jeager-exporter): deprecate jaeger exporter (#3585)

2f715bd feat: allow to add attributes from grpc metadata in the patched server (#3589)

cbbdfd3 fix(sdk-node): update instrumentations once MeterProvider is initialized (#3624)

4a4484a chore: update http example (#3651)

494efff fix(otlp-exporter-base): fix changelog for merged retry pr (#3650)

Additional commits viewable in compare view

Updates @opentelemetry/exporter-prometheus from 0.222.0 to 0.300.0

Release notes

Sourced from @​opentelemetry/exporter-prometheus's releases.

experimental/v0.300.0

0.300.0

Summary

The minimum supported Node.js has been raised to >=22.15.0. This means that support for Node.js 18 and 20 has been dropped.

The public interface has changed

for notes on migrating to 3.x / 0.300.x see the upgrade guide

Only stable versions 3.0.0 are compatible with this release

:boom: Breaking Changes

chore(shim-opencensus)!: remove the @opentelemetry/shim-opencensus package

In the OpenTelemetry Specification v1.58.0 the OpenCensus compatibility requirements were deprecated. The JavaScript OpenCensus shim package will not receive any more releases after the current 0.222.0 release (source code for last release).

feat(instrumentation-http)!: remove deprecated serverName field from HttpInstrumentationConfig #7081

The serverName option had no effect; stable HTTP semantic conventions do not include http.server_name. Remove it from any setConfig() or constructor call.

feat(sdk-node)!: remove deprecated NodeSDKConfiguration fields logRecordProcessor, metricReader, spanProcessor and deprecated namespace re-exports node, tracing

NodeSDKConfiguration.logRecordProcessor — use logRecordProcessors instead.

NodeSDKConfiguration.metricReader — use metricReaders instead.

NodeSDKConfiguration.spanProcessor — use spanProcessors instead.

export * as node from '@opentelemetry/sdk-node' — import directly from @opentelemetry/sdk-trace-node instead.

export * as tracing from '@opentelemetry/sdk-node' — import directly from @opentelemetry/sdk-trace-base instead.

feat(sdk-logs)!: remove deprecated SdkLogRecord type alias and LoggerProviderConfig type alias #7062

SdkLogRecord — use ReadWriteLogRecord instead.

LoggerProviderConfig — use LoggerProviderOptions instead.

feat!: migrate package builds from tsc to tsdown, emitting dual CJS/ESM output from a single dist/ directory and declaring an exports map on every package #6293 @​overbalance

Importing a package by its name is unaffected in both CommonJS and ESM, as is every subpath listed in its exports map.

Deep imports into the build output no longer resolve. An exports map is an allowlist that Node.js and bundlers enforce, so specifiers such as @opentelemetry/sdk-logs/build/src/... or @opentelemetry/sdk-logs/build/esm/... now fail with ERR_PACKAGE_PATH_NOT_EXPORTED. Rewriting them to the new file layout does not help — unlisted subpaths are rejected whether or not the file exists.

The emitted files moved out of build/src (CJS), build/esm and build/esnext (ESM) into dist/, using .cjs/.mjs extensions with matching .d.cts/.d.mts declarations.

<package>/package.json is no longer importable for the same reason. Read a package's version from your own dependency metadata, or use SDK_INFO from @opentelemetry/core for the SDK version.

The non-standard esnext entry point has been removed; tools that preferred it fall back to module (ESM) or main (CJS).

Packages that ship separate Node.js and browser implementations export them under explicit subpaths, for example @opentelemetry/sdk-logs/platform. If you depend on something that is only reachable through a deep import, please open an issue so it can be considered for the public API.

feat(sdk-node)!: remove "j

[Oneseco-Media/rsshub]

Bump @jocmp/mercury-parser from 3.1.0 to 3.1.2

By dependabot[bot]

Assigned to

Bumps @jocmp/mercury-parser from 3.1.0 to 3.1.2.

Release notes

Sourced from @​jocmp/mercury-parser's releases.

v3.1.2

What's Changed

build: target baseline widely available browsers by @​jocmp in jocmp/mercury-parser#215

chore(deps-dev): bump es-check from 9.6.4 to 9.8.1 by @​dependabot[bot] in jocmp/mercury-parser#221

chore(deps-dev): bump eslint from 10.8.1 to 10.11.0 by @​dependabot[bot] in jocmp/mercury-parser#220

Fix a handful of sites by @​benubois in jocmp/mercury-parser#222

chore(deps): bump dayjs from 1.11.21 to 1.11.23 by @​dependabot[bot] in jocmp/mercury-parser#218

Full Changelog: https://github.com/jocmp/mercury-parser/compare/v3.1.1...v3.1.2

v3.1.1

What's Changed

build: drop babel from the build and tests by @​jocmp in jocmp/mercury-parser#206

chore(deps): bump iconv-lite from 0.7.2 to 0.7.3 by @​dependabot[bot] in jocmp/mercury-parser#207

chore(deps-dev): bump inquirer from 13.4.3 to 14.0.2 by @​dependabot[bot] in jocmp/mercury-parser#208

chore(deps-dev): bump vite-plugin-node-polyfills from 0.26.0 to 0.28.0 by @​dependabot[bot] in jocmp/mercury-parser#210

chore(deps-dev): bump eslint from 10.8.0 to 10.8.1 by @​dependabot[bot] in jocmp/mercury-parser#211

chore(deps-dev): bump lint-staged from 16.4.0 to 17.5.1 by @​dependabot[bot] in jocmp/mercury-parser#209

feat: Add www.digitalfoundry.net custom parser by @​jocmp in jocmp/mercury-parser#212

ci: RSSHub-style consumer test by @​jocmp in jocmp/mercury-parser#213

refactor: replace legacy url module with WHATWG URL by @​jocmp in jocmp/mercury-parser#214

Update changelog by @​jocmp in jocmp/mercury-parser#216

Full Changelog: https://github.com/jocmp/mercury-parser/compare/v3.1.0...v3.1.1

Changelog

Sourced from @​jocmp/mercury-parser's changelog.

v3.1.2

Fix a handful of sites by @​benubois in #222

build: target baseline widely available browsers by @​jocmp in #215

v3.1.1

bump version v3.1.0 -> v3.1.1 by @​jocmp

Update changelog by @​jocmp in #216

refactor: replace legacy url module with WHATWG URL by @​jocmp in #214

refactor: replace legacy url module with WHATWG URL by @​jocmp

ci: RSSHub-style consumer test by @​jocmp in #213

feat: Add www.digitalfoundry.net custom parser by @​jocmp in #212

build: drop babel from the build and tests by @​jocmp in #206

Full Changelog: https://github.com/jocmp/mercury-parser/compare/v3.1.0...v3.1.1

Commits

0568626 bump version v3.1.1 -> v3.1.2

1125e48 Update changelog

0008f26 chore(deps): bump dayjs from 1.11.21 to 1.11.23 (#218)

d9ac9ed feat: Add journaldelagence.com, metsul.com, logic-immo and meilleursagents cu...

84e3f72 chore(deps-dev): bump eslint from 10.8.1 to 10.11.0 (#220)

7153271 chore(deps-dev): bump es-check from 9.6.4 to 9.8.1 (#221)

c583cae build: target baseline widely available browsers (#215)

5ca8cbe bump version v3.1.0 -> v3.1.1

1280fc8 Update changelog

b0c8532 fix: drop optional chaining for browser compat

Additional commits viewable in compare view

[

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• `@dependabot show

Labeled:

October 26, 2026 at 03:23AM

via GitHub https://ift.tt/3O2blyF

[Oneseco-Media/rsshub]

Bump postal-mime from 3.0.0 to 4.1.4

By dependabot[bot]

Assigned to

Bumps postal-mime from 3.0.0 to 4.1.4.

Release notes

Sourced from postal-mime's releases.

v4.1.4

4.1.4 (2026-10-22)

Bug Fixes

end the header block at the first line that is neither a field nor a fold (0018555)

honour only the utf-16 charset labels Python or iconv-lite decode (4d96a49)

honour only the utf-16 charset labels that Python and iconv-lite both decode (afbe5a9)

keep a base64 or quoted-printable message/rfc822 part as an attachment (0e0582e)

percent encode a mailto address in runs instead of one character at a time (dd73f5c)

percent encode the mailto address in the demo (7da508e)

read a multipart whose boundary holds a non-ASCII character as text/plain (a7d4dad)

read the transfer encoding token from the start of the value only (e66830a)

reject a maxPartCount of zero as an invalid option (35bde9d)

render the dates of forwarded headers with one shared formatter (ca27168)

unfold format=flowed text in a text/plain part only (336378a)

v4.1.3

4.1.3 (2026-10-21)

Bug Fixes

honour a byte order mark only under a utf-16 label that leaves the order open (db9a6ce)

v4.1.2

4.1.2 (2026-10-21)

Bug Fixes

copy the characters of a structured header as runs instead of one at a time (f0edeee)

v4.1.1

4.1.1 (2026-10-21)

Bug Fixes

decode a charset of the replacement encoding to the replacement character (0624f77)

drop a script or style body holding any line terminator from the text of an html part (78e00e6)

keep the whitespace around a field name in its key (8b79d3e)

let a byte order mark decide the byte order under a utf-16 label (0624f77)

match a boundary line against the outermost open boundary first (a2083ec)

match the Content-Transfer-Encoding token whole, so x-base64 decodes nothing (8b79d3e)

never read a mailbox out of an encoded word (e06badb)

percent-encode the address of a mailto link in a rendered forwarded header (78e00e6)

read the Content-Disposition type up to the first whitespace (8b79d3e)

render the text of inline forwards once, at the root parser (a2083ec)

... (truncated)

Changelog

Sourced from postal-mime's changelog.

4.1.4 (2026-10-22)

Bug Fixes

end the header block at the first line that is neither a field nor a fold (0018555)

honour only the utf-16 charset labels Python or iconv-lite decode (4d96a49)

honour only the utf-16 charset labels that Python and iconv-lite both decode (afbe5a9)

keep a base64 or quoted-printable message/rfc822 part as an attachment (0e0582e)

percent encode a mailto address in runs instead of one character at a time (dd73f5c)

percent encode the mailto address in the demo (7da508e)

read a multipart whose boundary holds a non-ASCII character as text/plain (a7d4dad)

read the transfer encoding token from the start of the value only (e66830a)

reject a maxPartCount of zero as an invalid option (35bde9d)

render the dates of forwarded headers with one shared formatter (ca27168)

unfold format=flowed text in a text/plain part only (336378a)

4.1.3 (2026-10-21)

Bug Fixes

honour a byte order mark only under a utf-16 label that leaves the order open (db9a6ce)

4.1.2 (2026-10-21)

Bug Fixes

copy the characters of a structured header as runs instead of one at a time (f0edeee)

4.1.1 (2026-10-21)

Bug Fixes

decode a charset of the replacement encoding to the replacement character (0624f77)

drop a script or style body holding any line terminator from the text of an html part (78e00e6)

keep the whitespace around a field name in its key (8b79d3e)

let a byte order mark decide the byte order under a utf-16 label (0624f77)

match a boundary line against the outermost open boundary first (a2083ec)

match the Content-Transfer-Encoding token whole, so x-base64 decodes nothing (8b79d3e)

never read a mailbox out of an encoded word (e06badb)

percent-encode the address of a mailto link in a rendered forwarded header (78e00e6)

read the Content-Disposition type up to the first whitespace (8b79d3e)

render the text of inline forwards once, at the root parser (a2083ec)

trim trailing whitespace off a boundary parameter, as Python does (8b79d3e)

4.1.0 (2026-10-21)

... (truncated)

Commits

d96e201 chore(master): release 4.1.4 (#121)

c93049e docs: note that whitespace before the colon keeps a line a header

afbe5a9 fix: honour only the utf-16 charset labels that Python and iconv-lite both de...

faf1be5 docs: state that maxPartCount must be positive

a29b895 test: consolidate the header block and utf-16 label tests

dd0c2ec refactor: drop the whitespace-only line bookkeeping the header block rule sub...

060083d refactor: resolve the utf-16 charset labels through one table of their own

fa4bbf0 refactor: encode a mailto address with one replace over its unsafe runs

b4c129e docs: describe how a malformed message is read and which attachment fields ar...

33c4fc9 test: measure dated inline forwards and a long percent-encoded forwarded address

Additional commits viewable in compare view

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

[

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• `@dependabot show

Labeled:

October 26, 2026 at 03:22AM

via GitHub https://ift.tt/rBTL4uU

[Oneseco-Media/rsshub]

Bump @googleapis/youtube from 38.0.0 to 40.0.2

By dependabot[bot]

Assigned to

Bumps @googleapis/youtube from 38.0.0 to 40.0.2.

Release notes

Sourced from @​googleapis/youtube's releases.

youtube: v40.0.2

40.0.2 (2026-10-22)

Bug Fixes

youtube: update the API (e38e735)

youtube: v40.0.1

40.0.1 (2026-10-14)

Bug Fixes

youtube: update the API (62f24f4)

bigtableadmin: v39.2.0

39.2.0 (2026-10-19)

Features

bigtableadmin: update the API (d6ff5db)

run: v38.4.0

38.4.0 (2026-10-22)

Features

run: update the API (37e8fcf)

run: v38.3.0

38.3.0 (2026-10-14)

Features

run: update the API (673f9ae)

networkservices: v38.3.0

38.3.0 (2026-10-22)

Features

networkservices: update the API (5765b45)

networkservices: v38.2.1

38.2.1 (2026-10-14)

... (truncated)

Commits

206bd03 chore: release main (#4055)

71d410e feat: regenerate index files

e38e735 fix(youtube): update the API

08bfe07 feat(travelimpactmodel): update the API

37e8fcf feat(run): update the API

fd16c5f fix(policytroubleshooter): update the API

5765b45 feat(networkservices): update the API

a35f802 feat(iam): update the API

e14b75e fix(health): update the API

cb29ebe feat(firebaseml): update the API

Additional commits viewable in compare view

[

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• `@dependabot show

Labeled:

October 26, 2026 at 03:22AM

via GitHub https://ift.tt/dLPIFWv

[Oneseco-Media/rsshub]

Bump @notionhq/client from 5.26.0 to 5.28.0

By dependabot[bot]

Assigned to

Bumps @notionhq/client from 5.26.0 to 5.28.0.

Release notes

Sourced from @​notionhq/client's releases.

v5.28.0

What’s changed

API response types

Status properties include default_option (#814)

Status property configs in data source responses now have a read-only default_option: string | null. It is the name of the option a page shows when it has no explicit Status value, or null when no default is configured. See Status.

The field is required on the response type, so code that builds these objects by hand, such as test fixtures, needs to add it.

Internals

The publish and version bump workflows pin Node.js 22.23.4 (#815).

Links

Full Changelog: https://github.com/makenotion/notion-sdk-js/compare/v5.27.1...v5.28.0

NPM Package: https://www.npmjs.com/package/@​notionhq/client/v/5.28.0

v5.27.1

What’s changed

Bug fixes

Cloudflare Workers and Deno workers are no longer treated as browsers (#809)

Since v5.27.0, creating a client with auth in Cloudflare Workers or a Deno worker thread threw BrowserTokenNotAllowedError, and the client stopped sending its user-agent header there. Both work again.

A worker now counts as a browser only when its global object is an instance of WorkerGlobalScope and it has an importScripts function. Browser pages, web workers, shared workers, and service workers are still blocked.

If you added dangerouslyAllowBrowser: true as a workaround on a server runtime, you can remove it.

Internals

The version bump workflow checks contract changes against the last release tag, so a reviewed type change can merge before its minor release without landing in a patch (#807).

Links

Full Changelog: https://github.com/makenotion/notion-sdk-js/compare/v5.27.0...v5.27.1

NPM Package: https://www.npmjs.com/package/@​notionhq/client/v/5.27.1

v5.27.0

What’s changed

Behavior changes

Tokens are blocked in browsers by default (#791)

In a browser page, web worker, or service worker, constructing a client with auth throws BrowserTokenNotAllowedError. Per-request auth and OAuth client credentials reject with the same error before anything is sent. Anyone who can load the page can read the token and act as the connection.

Pass dangerouslyAllowBrowser: true to opt out, for example in jsdom tests. A client without a token still works in a browser, such as one whose baseUrl points at your own server. See the README's "Browser usage" section.

New capabilities

Agent Skills API (#804)

Adds client.plugins.list(), client.plugins.retrieve(), and client.skills.retrieve(). The retrieve methods return a signed archive URL. They don't download or extract files.

... (truncated)

Commits

10aa976 Bump version to v5.28.0 (#816)

9f7f4a1 Add default_option to Status property responses (#814)

858fb6e Pin Node 22.23.4 in publish and version workflows (Node Brotli RCE) (#815)

0ffdbba Bump version to v5.27.1 (#811)

3cf7286 Stop treating Cloudflare Workers and Deno workers as browsers (#809)

37d6d24 Allow reviewed contract changes before their minor release (#807)

25a755e Bump version to v5.27.0 (#806)

37025ab [AI] Add doc comments to property discriminators in Query sessions filter p...

ebd7740 [AI] Document empty bounded pages in query sessions response (#788)

a641494 [AI] Remove redacted tool-call input/output/error fields and update `ve...

Additional commits viewable in compare view

[

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• `@dependabot show

Labeled:

October 26, 2026 at 03:21AM

via GitHub https://ift.tt/v6Id7Ac

[Oneseco-Media/rsshub]

Bump query-string from 9.5.1 to 10.0.0

By dependabot[bot]

Assigned to

Bumps query-string from 9.5.1 to 10.0.0.

Release notes

Sourced from query-string's releases.

v10.0.0

Breaking

Require Node.js 22 dc9cd5e

stringify() now throws a TypeError for values it cannot represent, like objects, functions, symbols, and Date 99d9c07

Before, {a: {}} became a=%5Bobject%20Object%5D. Use the replacer option to convert such values.

parse() now collects a repeated key into an array with every arrayFormat 27018f4 a6d6a7f

Before, bracket, index, colon-list-separator, bracket-separator, comma, and separator kept only the last value, so foo=1&foo=2 gave {foo: '2'}.

An explicit types entry now always takes precedence over parseNumbers and parseBooleans, and a value that does not match its type stays a string 04649de f48a249

The string[] and number[] types now always give an array (except with arrayFormat: 'none', as documented) 04649de 2a6984f

A percent-encoded byte that is not valid UTF-8 now decodes to U+FFFD, like URLSearchParams, instead of being kept as-is 19331de

arrayFormat: 'bracket-separator' no longer splits on a percent-encoded separator, like comma and separator (#398) deb9784

foo[]=a%2Cb,c now gives ['a,b', 'c'].

stringifyUrl() now percent-encodes % in fragmentIdentifier 1602ae0

The fragment identifier is now a decoded value, like the query values, so it round-trips with parseUrl(). If you passed an already encoded fragment identifier, pass it decoded.

pick() and exclude() now write the kept parameters back exactly as they were in the URL 1646c64 e087ca9 a7391f2

Options like parseNumbers, parseBooleans, types, and decode only change the value the filter receives. Before, pick('https://foo.bar?id=007', ['id'], {parseNumbers: true}) gave id=7.

Improvements

Remove the decode-uri-component dependency and decode in linear time 19331de

The old decoder was quadratic for some malformed input.

Fix parse() being quadratic for a key that repeats many times with arrayFormat: 'comma' and 'separator' 00a52ff

TypeScript: The parsed value types now follow the parseNumbers, parseBooleans, and types options, also for parseUrl(), pick(), and exclude() d239f4f 472777f 789fc36

An option that is explicitly undefined now uses its default value 1646c64

Fixes

Fix stringify() output that did not parse back to the same value 13bc381 b63dc56 deb9784

This affected a separator like - or . inside a value, null items with colon-list-separator, and arrays that became empty after skipping items with bracket-separator.

Fix stringify() throwing URIError for a string with a lone surrogate b9ff3f8

Fix the sort option 220906a 678ddff 6c6506d

sort: true threw in stringify(), parse() threw when sort was not a boolean or a function, sort: false broke arrayFormat: 'index', and pick() ignored sort: false.

Fix stringifyUrl() turning an index format array that is already in the URL into [object Object] (#422) 220906a

Fix stringifyUrl(), pick(), and exclude() corrupting the query and the fragment identifier with encode: false 7268b7a c75c681

Fix stringifyUrl() changing the parameters that are already in the URL when you give it parse options 93c3e1e

Fix parseUrl() and stringifyUrl() keeping leading and trailing whitespace 1d91dbf 93c3e1e

Fix parse() throwing for arrayFormat: 'index' when a plain value comes before the indexed entries 8e9d58d

Fix parse() using types keys inherited from Object.prototype, like toString (#421) 0682872

Fix stringify() ignoring the replacer result for skipNull and skipEmptyString 42210ea

Fix stringify() reading each value twice, which ran getters and Proxy traps two times 5e50210

Fix stringifyUrl() not accepting an interface for query cd042b8

https://github.com/sindresorhus/query-string/compare/v9.5.1...v10.0.0

Commits

bea7bdc 10.0.0

76b3968 Tweaks

678ddff Fix parse() throwing for a sort that is not a boolean or a function

c75c681 Fix pick() and exclude() corrupting the query for an encode that is null

19331de Replace decode-uri-component with a linear decoder

dc9cd5e Require Node.js 22

8623e20 Ignore a types value that is not a supported type for an array too

c4cd28a More tests

f016142 Simplify the array format encoder and parser

93c3e1e Fix stringifyUrl() rewriting the query parameters in the URL and keeping le...

Additional commits viewable in compare view

[

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• `@dependabot show

Labeled:

October 26, 2026 at 03:20AM

via GitHub https://ift.tt/tW5Dclq

[Oneseco-Media/rsshub]

Bump rolldown from 1.2.8 to 1.2.15

By dependabot[bot]

Assigned to

Bumps rolldown from 1.2.8 to 1.2.15.

Release notes

Sourced from rolldown's releases.

v1.2.15

[1.2.15] - 2026-10-21

🚀 Features

rolldown_plugin_vite_resolve: add isBundled to pick the browser-external stub format (#11260) by @​h-a-n-a

dev: mark entry modules in the HMR module graph (#11252) by @​h-a-n-a

mark module starts with // <id> comments instead of #region pairs (#11235) by @​IWANABETHATGUY

🐛 Bug Fixes

plugin: stop this.resolve recursion between plugins with skipSelf: true (#11181) by @​anzal1

rolldown_plugin_vite_resolve: handle external require for ssr.target: 'webworker' (#11205) by @​sapphi-red

rolldown_plugin_vite_build_import_analysis: only wrap dynamic imports with static specifiers in __vitePreload (#10879) by @​smeng9

strict-execution-order: wrap eager modules that forward wrapped definers (#11186) by @​hyfdev

chunk-import-map: keep common chunk keys unique when enabling inline common chunks (#11230) by @​hyfdev

only register signal-exit handler when a trace subscriber is active (#11208) by @​DaniilIsupov

🧪 Testing

fold hand-unrolled Rust test tables (#11212) by @​Brooooooklyn

⚙️ Miscellaneous Tasks

deps: upgrade oxc to 0.155.0 (#11228) by @​Dunqing

rollup-tests: retriage failed tests (#11251) by @​sapphi-red

deps: update rollup submodule for tests to v4.64.12 (#11249) by @​rolldown-guard[bot]

deps: update test262 submodule for tests (#11242) by @​rolldown-guard[bot]

❤️ New Contributors

@​anzal1 made their first contribution in #11181

@​smeng9 made their first contribution in #10879

@​DaniilIsupov made their first contribution in #11208

Co-authored-by: shulaoda 165626830+shulaoda@users.noreply.github.com

v1.2.14

[1.2.14] - 2026-10-14

🚀 Features

add output.charset option (#11194) by @​sapphi-red

code-splitting: route independent ESM re-exports per consumer (#11177) by @​hyfdev

🐛 Bug Fixes

handle output.charset: 'ascii' + output.minify: false (#11207) by @​sapphi-red

tree-shaking: preserve initialization of wrapped ESM re-exports (#11167) by @​hyfdev

sourcemap: preserve boundaries when tracing has no mapping (#11170) by @​sapphi-red

... (truncated)

Changelog

Sourced from rolldown's changelog.

[1.2.15] - 2026-10-21

🚀 Features

rolldown_plugin_vite_resolve: add isBundled to pick the browser-external stub format (#11260) by @​h-a-n-a

dev: mark entry modules in the HMR module graph (#11252) by @​h-a-n-a

mark module starts with // <id> comments instead of #region pairs (#11235) by @​IWANABETHATGUY

🐛 Bug Fixes

plugin: stop this.resolve recursion between plugins with skipSelf: true (#11181) by @​anzal1

rolldown_plugin_vite_resolve: handle external require for ssr.target: 'webworker' (#11205) by @​sapphi-red

rolldown_plugin_vite_build_import_analysis: only wrap dynamic imports with static specifiers in __vitePreload (#10879) by @​smeng9

strict-execution-order: wrap eager modules that forward wrapped definers (#11186) by @​hyfdev

chunk-import-map: keep common chunk keys unique when enabling inline common chunks (#11230) by @​hyfdev

only register signal-exit handler when a trace subscriber is active (#11208) by @​DaniilIsupov

🧪 Testing

fold hand-unrolled Rust test tables (#11212) by @​Brooooooklyn

⚙️ Miscellaneous Tasks

deps: upgrade oxc to 0.155.0 (#11228) by @​Dunqing

rollup-tests: retriage failed tests (#11251) by @​sapphi-red

deps: update rollup submodule for tests to v4.64.12 (#11249) by @​rolldown-guard[bot]

deps: update test262 submodule for tests (#11242) by @​rolldown-guard[bot]

❤️ New Contributors

@​anzal1 made their first contribution in #11181

@​smeng9 made their first contribution in #10879

@​DaniilIsupov made their first contribution in #11208

[1.2.14] - 2026-10-14

🚀 Features

add output.charset option (#11194) by @​sapphi-red

code-splitting: route independent ESM re-exports per consumer (#11177) by @​hyfdev

🐛 Bug Fixes

handle output.charset: 'ascii' + output.minify: false (#11207) by @​sapphi-red

tree-shaking: preserve initialization of wrapped ESM re-exports (#11167) by @​hyfdev

sourcemap: preserve boundaries when tracing has no mapping (#11170) by @​sapphi-red

strict-execution-order: account for init imports during code splitting (#11162) by @​hyfdev

strict-execution-order: avoid eager loading through mixed re-exports (#11151) by @​hyfdev

tree-shake expression statements that coerce known constants (#10825) by @​IWANABETHATGUY

... (truncated)

Commits

89d821c release: v1.2.15 (#11261)

3b0841e feat(rolldown_plugin_vite_resolve): add isBundled to pick the browser-exter...

a973d41 chore(deps): upgrade oxc to 0.155.0 (#11228)

5bfb74e feat(dev): mark entry modules in the HMR module graph (#11252)

fb0a8db fix(rolldown_plugin_vite_resolve): handle external require for `ssr.target:...

547a5a7 fix(rolldown_plugin_vite_build_import_analysis): only wrap dynamic imports wi...

648591f feat: mark module starts with // <id> comments instead of #region pairs (...

3f03741 fix(chunk-import-map): keep common chunk keys unique when enabling inline com...

33a987d fix: only register signal-exit handler when a trace subscriber is active (#11...

c9a8cda release: v1.2.14 (#11210)

Additional commits viewable in compare view

[

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• `@dependabot show

Labeled:

October 26, 2026 at 03:20AM

via GitHub https://ift.tt/9cnW562

[Oneseco-Media/rsshub]

Bump tldts from 7.4.12 to 7.4.19

By dependabot[bot]

Assigned to

Bumps tldts from 7.4.12 to 7.4.19.

Release notes

Sourced from tldts's releases.

v7.4.19

:scroll: Update Public Suffix List

tldts-experimental, tldts

Update upstream public suffix list #2718 (@​remusao)

:nut_and_bolt: Dependencies

tldts-experimental

Bump typescript-eslint from 8.70.1 to 8.71.0 #2698 (@​dependabot[bot] @​remusao)

Authors: 2

@​dependabot[bot]

Rémi (@​remusao)

v7.4.18

:scroll: Update Public Suffix List

tldts-experimental, tldts-icann, tldts

Update upstream public suffix list #2708 (@​remusao)

:nut_and_bolt: Dependencies

Bump mocha from 12.0.2 to 12.0.3 #2700 (@​dependabot[bot])

Bump @​types/node from 26.6.2 to 26.6.4 #2701 (@​dependabot[bot])

Bump globals from 17.12.0 to 17.13.0 #2702 (@​dependabot[bot])

Bump chai from 6.2.2 to 6.3.0 #2703 (@​dependabot[bot])

Bump rollup from 4.63.5 to 4.64.0 #2704 (@​dependabot[bot])

Bump eslint from 10.11.0 to 10.12.0 #2705 (@​dependabot[bot])

Bump postcss-selector-parser from 7.1.5 to 7.1.6 #2707 (@​dependabot[bot])

Bump serialize-javascript from 7.1.1 to 7.1.2 #2706 (@​dependabot[bot])

Bump ip-address from 10.4.0 to 10.7.2 #2697 (@​dependabot[bot])

Bump prettier from 3.9.8 to 3.9.9 #2692 (@​dependabot[bot])

Bump rollup-plugin-sourcemaps2 from 0.5.8 to 0.5.9 #2693 (@​dependabot[bot])

Bump rollup from 4.63.4 to 4.63.5 #2694 (@​dependabot[bot])

Authors: 2

@​dependabot[bot]

Rémi (@​remusao)

v7.4.16

:scroll: Update Public Suffix List

tldts-core, tldts-experimental, tldts-icann, tldts-tests, tldts-utils, tldts

Updates #2691 (@​remusao)

Authors: 1

... (truncated)

Changelog

Sourced from tldts's changelog.

v7.4.19 (Tue Oct 20 2026)

:scroll: Update Public Suffix List

tldts-experimental, tldts

Update upstream public suffix list #2718 (@​remusao)

:nut_and_bolt: Dependencies

tldts-experimental

Bump typescript-eslint from 8.70.1 to 8.71.0 #2698 (@​dependabot[bot] @​remusao)

Authors: 2

@​dependabot[bot]

Rémi (@​remusao)

v7.4.17 (Wed Oct 07 2026)

:scroll: Update Public Suffix List

tldts-experimental, tldts-icann, tldts

Update upstream public suffix list #2708 (@​remusao)

:nut_and_bolt: Dependencies

Bump mocha from 12.0.2 to 12.0.3 #2700 (@​dependabot[bot])

Bump @​types/node from 26.6.2 to 26.6.4 #2701 (@​dependabot[bot])

Bump globals from 17.12.0 to 17.13.0 #2702 (@​dependabot[bot])

Bump chai from 6.2.2 to 6.3.0 #2703 (@​dependabot[bot])

Bump rollup from 4.63.5 to 4.64.0 #2704 (@​dependabot[bot])

Bump eslint from 10.11.0 to 10.12.0 #2705 (@​dependabot[bot])

Bump postcss-selector-parser from 7.1.5 to 7.1.6 #2707 (@​dependabot[bot])

Bump serialize-javascript from 7.1.1 to 7.1.2 #2706 (@​dependabot[bot])

Bump ip-address from 10.4.0 to 10.7.2 #2697 (@​dependabot[bot])

Bump prettier from 3.9.8 to 3.9.9 #2692 (@​dependabot[bot])

Bump rollup-plugin-sourcemaps2 from 0.5.8 to 0.5.9 #2693 (@​dependabot[bot])

Bump rollup from 4.63.4 to 4.63.5 #2694 (@​dependabot[bot])

Authors: 2

@​dependabot[bot]

Rémi (@​remusao)

v7.4.16 (Sun Sep 27 2026)

... (truncated)

Commits

4ecabd1 Bump version to: v7.4.19 [skip ci]

16329e8 Update CHANGELOG.md [skip ci]

9230c1c Update upstream public suffix list (#2718)

1073d06 Bump typescript-eslint from 8.70.1 to 8.71.0 (#2698)

3ac3c4c Bump version to: v7.4.18 [skip ci]

c99de8e Update CHANGELOG.md [skip ci]

8c86c3e Bump mocha from 12.0.2 to 12.0.3 (#2700)

989bef8 Bump @​types/node from 26.6.2 to 26.6.4 (#2701)

28ad8bf Bump globals from 17.12.0 to 17.13.0 (#2702)

4890c0d Bump chai from 6.2.2 to 6.3.0 (#2703)

Additional commits viewable in compare view

[

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• `@dependabot show

Labeled:

October 26, 2026 at 03:19AM

via GitHub https://ift.tt/XywrsBO

[Cybersoulja/trill-local-runtime]

LOCAL O

By Cybersoulja

Assigned to Cybersoulja

We need a dedicated local AI for the @trillastrobot telegram bot.

Labeled:

October 25, 2026 at 01:50PM

via GitHub https://ift.tt/xa8rbXz

[Oneseco-Media/rsshub]

Bump imapflow from 2.0.2 to 2.5.8

By dependabot[bot]

Assigned to

Bumps imapflow from 2.0.2 to 2.5.8.

Changelog

Sourced from imapflow's changelog.

2.5.8 (2026-10-19)

Bug Fixes

use the bundled libmime, libqp, libbase64 and encoding-japanese types (c1e2e32)

2.5.7 (2026-10-19)

Bug Fixes

bump libmime to 5.5.2 (8f0f6f7)

2.5.6 (2026-10-19)

Bug Fixes

read SEARCH answers into a number array and reject search() when the command did not complete (78bfccf), closes #443 #444

2.5.5 (2026-10-18)

Bug Fixes

bump libmime to 5.5.1, libqp to 3.0.1, libbase64 to 1.4.1 and @​zone-eu/mailsplit to 5.4.26 (d5dc4b5)

2.5.4 (2026-10-18)

Bug Fixes

bump @​zone-eu/mailsplit to 5.4.25 (b42e695)

2.5.3 (2026-10-18)

Bug Fixes

bump @​zone-eu/mailsplit to 5.4.24 (ab82e4f)

2.5.2 (2026-10-16)

Bug Fixes

bump @​zone-eu/mailsplit to 5.4.23 (e758c81)

bump libmime to 5.4.9 and libqp to 2.1.3 (0ea7730)

... (truncated)

Commits

2623ea0 Merge pull request #447 from postalsys/release-please--branches--master--comp...

5f73d58 chore(master): release 2.5.8 [skip-ci]

c1e2e32 fix: use the bundled libmime, libqp, libbase64 and encoding-japanese types

ba4df88 Merge pull request #446 from postalsys/release-please--branches--master--comp...

87cfe5e chore(master): release 2.5.7 [skip-ci]

8f0f6f7 fix: bump libmime to 5.5.2

9ebf5da ci: test on the latest Node.js release

d28dfc2 ci: guard the CommonJS dependency graph

af8f758 docs: state the Node 20 and CommonJS platform constraints

86be359 ci: move workflow actions to checkout v7, setup-node v7 and release-please v5

Additional commits viewable in compare view

[

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• `@dependabot show

Labeled:

October 23, 2026 at 03:11AM

via GitHub https://ift.tt/83Jwub7

[Oneseco-Media/rsshub]

Bump discord-api-types from 0.38.55 to 0.38.57

By dependabot[bot]

Assigned to

Bumps discord-api-types from 0.38.55 to 0.38.57.

Release notes

Sourced from discord-api-types's releases.

0.38.57

0.38.57 (2026-10-19)

Features

oauth2: support iss (#1837 by @​Jiralite) (f3ce294)

Full Changelog: https://github.com/discordjs/discord-api-types/compare/0.38.56...0.38.57

0.38.56

0.38.56 (2026-09-28)

Bug Fixes

AutoModeration: allow null custom_message (#1810 by @​almeidx) (e2c4565)

remove options and handler respectively (#1793 by @​Jiralite) (dbde4ee)

User: narrow create dm channel result (#1795 by @​RiskyMH) (50752c0)

Features

application identity profiles (#1799 by @​sdanialraza) (be102d7)

game mention (#1788 by @​Jiralite) (0e83e98)

GuildFeature: add PruneRequiresAdmin (#1770 by @​kshitijanurag) (567f099)

RESTJSONErrorCodes: add 160009 &160010 (forward message errors) (#1697 by @​RiskyMH) (7484c1d)

Full Changelog: https://github.com/discordjs/discord-api-types/compare/0.38.55...0.38.56

Changelog

Sourced from discord-api-types's changelog.

0.38.57 (2026-10-19)

Features

oauth2: support iss (#1837) (f3ce294)

0.38.56 (2026-09-28)

Bug Fixes

AutoModeration: allow null custom_message (#1810) (e2c4565)

remove options and handler respectively (#1793) (dbde4ee)

User: narrow create dm channel result (#1795) (50752c0)

Features

application identity profiles (#1799) (be102d7)

game mention (#1788) (0e83e98)

GuildFeature: add PruneRequiresAdmin (#1770) (567f099)

RESTJSONErrorCodes: add 160009 &160010 (forward message errors) (#1697) (7484c1d)

Commits

29c82ff chore(release): 0.38.57 🎉 (#1842)

f3ce294 feat(oauth2): support iss (#1837)

6605c8d chore(deps): update patch/minor dependencies (#1839)

e394832 chore(deps): update eslint/prettier (#1838)

35cd1b2 chore(deps): update patch/minor dependencies (#1830)

68ef959 chore(deps): update eslint/prettier (#1829)

865af57 chore(deps): update patch/minor dependencies (#1824)

19c9ddd chore(deps): update eslint/prettier to v8.71.0 (#1823)

7c75edb chore(release): 0.38.56 🎉 (#1819)

da3895f chore(deps): update patch/minor dependencies (#1817)

Additional commits viewable in compare view

[

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• `@dependabot show

Labeled:

October 23, 2026 at 03:10AM

via GitHub https://ift.tt/i4w2dnk

[Oneseco-Media/rsshub]

Bump undici from 8.10.2 to 8.12.3

By dependabot[bot]

Assigned to

Bumps undici from 8.10.2 to 8.12.3.

Release notes

Sourced from undici's releases.

v8.12.3

What's Changed

ci: use Python 3.14 for the WPT server on macOS by @​mrityunjay-pandey in nodejs/undici#6029

build(deps-dev): bump neostandard from 0.13.0 to 0.14.0 by @​dependabot[bot] in nodejs/undici#6006

build(deps-dev): bump eslint from 9.39.4 to 10.12.0 by @​dependabot[bot] in nodejs/undici#5967

docs: document the options of interceptors.cache() by @​qodelicious in nodejs/undici#6050

fix(h2): replace a connection that stops responding after a stream timeout by @​mcollina in nodejs/undici#6052

fix(pool): keep caller async context for queued requests by @​mcollina in nodejs/undici#5982

New Contributors

@​qodelicious made their first contribution in nodejs/undici#6050

Full Changelog: https://github.com/nodejs/undici/compare/v8.12.2...v8.12.3

v8.12.2

Security fixes

High severity

Denial of service via TLS 1.2 certificate-changing renegotiation

CVE-2026-87018 · GHSA-qrxm-fqhp-jwvm

A malicious or compromised HTTPS server could crash the Node.js process by initiating TLS 1.2 renegotiation and presenting a different, CA-trusted certificate whose hostname did not match the requested host. The resulting socket error reached an assertion in undici's HTTP/1.1 and HTTP/2 connection handling. This release handles post-connect certificate errors without terminating the process.

TLS certificate validation bypass through dropped Agent options

CVE-2026-109383 · GHSA-2m5v-pch6-74hx

Agent used a JSON-based clone for constructor options, which silently removed function-valued TLS options such as checkServerIdentity. Applications relying on custom certificate or public-key verification could therefore accept a certificate that the callback was intended to reject. This release preserves TLS options when creating per-origin dispatchers.

Cache poisoning and cross-user disclosure through cross-origin redirects

CVE-2026-109829 · GHSA-4w7w-5xrc-9h26

When an originless Agent combined redirect and shared-cache interceptors as compose(redirect(), cache()), a response from a cross-origin redirect could be stored under the original URL. This could allow persistent cache poisoning or disclosure of user-specific responses to later callers. This release verifies the response origin before caching and preserves redirect-hop cache-control policy.

Denial of service through excessive Content-Encoding values

CVE-2026-109869 · GHSA-xjj6-f33q-929c

A malicious HTTP server could crash the Node.js process by returning more than five content codings and closing the connection before sending the body. Although fetch() rejected the response, an error from an orphaned internal stream could remain unhandled. This release validates the content-encoding chain before creating the body stream and aborts oversized chains safely.

Medium severity

Denial of service through the decompress interceptor

CVE-2026-87029 · GHSA-55wc-3pg8-jfw6

... (truncated)

Commits

ff9cc5e Bumped v8.12.3 (#6053)

0bbf614 fix(pool): keep caller async context for queued requests (#5982)

aa1eef1 fix(h2): replace a connection that stops responding after a stream timeout (#...

e34b872 docs: document the options of interceptors.cache() (#6050)

e8f3423 build(deps-dev): bump eslint from 9.39.4 to 10.12.0 (#5967)

b777e40 build(deps-dev): bump neostandard from 0.13.0 to 0.14.0 (#6006)

43700ff ci: use Python 3.14 for the WPT server on macOS (#6029)

bb6cc0a Bumped v8.12.2 (#6021)

b217373 fix(websocket): bound automatic PONG writes under backpressure

789ef26 fix(eventsource): bound retained SSE parser state

Additional commits viewable in compare view

[

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• `@dependabot show

Labeled:

October 23, 2026 at 03:10AM

via GitHub https://ift.tt/u8V5KFo

[Oneseco-Media/AI-Plaza]

🔒 Fix insufficient input validation for AI prompts

By Cybersoulja

Assigned to

🎯 What: Added Zod schema validation to the /ai-town/dialogue, /ai-town/world-event, and /ai-town/task-outcome endpoints in api-server. ⚠️ Risk: Unvalidated inputs from req.body were passed directly into OpenAI prompt strings. This allowed for potential prompt injection, abuse, or large payload attacks because size, characters, and existence weren't thoroughly validated. 🛡️ Solution: Added Zod to strictly validate the payload for all three endpoints. The new schemas enforce proper types and implement length restrictions (e.g. max length 100 for short names, 200 for tasks). Responses properly reject invalid or oversized inputs before interacting with the AI model.

PR created automatically by Jules for task 17934983536274278516 started by @Cybersoulja

Labeled:

October 23, 2026 at 02:58AM

via GitHub https://ift.tt/rG5g6Pd

[Cybersoulja/Agentic-Telegram-TMA]

BeatinDaBlock: open-mic scene + first DJ rhythm encounter

By Cybersoulja

Assigned to

What this does

First milestone: open a text scene, enter a DJ encounter, hear four sounds, repeat them, and get a saved reward.

• Story: the game now opens at the BeatinDaBlock open mic (Enter the showcase / Explore the block / Rehearse). The old Millbrook adventure is still reachable via "Explore the block".
• Rhythm encounter (RhythmEncounter.tsx): Listen → count-in → Your turn → Score → back to the story. Pattern playback is scheduled on the Web Audio clock; taps are timestamped relative to the start of the player's turn. Timing window is ±150 ms (windowMs).
• Sounds: dependency-free Web Audio synth with a DJ set (kick, snare, hi-hat, bass). Sound sets are swappable, so the combat set can be added later without touching pattern/scoring code.
• Backend: POST /api/rpg/encounter re-scores the reported hits and awards cash / reputation / hype into a new rpg_progress table; GET /api/rpg/progress returns totals. Both are gated by authenticateInitData.

Things to know

• Hit times come from the client, so they can be faked. The server bounds them and enforces an 8 s cooldown per user to limit reward farming; it is not cheat-proof.
• Patterns/scoring are duplicated on the frontend (lib/rhythm/pattern.ts) for playback and an offline preview grade. The server copy is authoritative. Documented in CLAUDE.md.
• In a plain browser (mock user) rewards can't be saved; the UI shows a preview grade and says so.
• After deploy, hit GET /api/db/init once to create the new rpg_progress table.
• Not included yet: combat sound set, idle rehearsal.

Testing

• npm run check-types, npm run build:frontend: pass. oxlint: no new warnings.
• Scoring checked with a script (perfect, late, wrong pad, spam, half).
• Ran wrangler dev with locally-signed initData: reward saved, repeat within the cooldown paid nothing, invalid encounter returned 400, unauthenticated returned 403.
• Not tested: actual audio and tap timing on a device. That needs a human with ears.

_Generated by [Claude Code](https://ift.tt/WMkzRvT

Labeled:

October 22, 2026 at 07:04PM

via GitHub https://ift.tt/dXGkCNA

[Oneseco-Media/rsshub]

Bump postal-mime from 3.0.0 to 4.0.11

By dependabot[bot]

Assigned to

Bumps postal-mime from 3.0.0 to 4.0.11.

Release notes

Sourced from postal-mime's releases.

v4.0.11

4.0.11 (2026-10-18)

Bug Fixes

read address groups in the same pass as the rest of the list (a951c80)

v4.0.10

4.0.10 (2026-10-18)

Bug Fixes

handle an address list without copying it per address (ad33b56)

tokenize addresses into offsets instead of an object per token (1026499)

v4.0.9

4.0.9 (2026-10-18)

Bug Fixes

apply the unexpected "<" rule outside quotes and comments (bb2cc7b)

bound group nesting at ten levels (01645e4)

drop the obsolete route from an angle-addr (101d7fb)

end a comment only at the ")" that closes the outermost one (1bd922f)

honour quoted strings and comments inside an angle-addr and a group (005a68a)

never read a mailbox out of a comment (b7681ee)

read CFWS beside the "@" of an addr-spec as nothing (a1475ed)

read the first addr-spec of the display text (db5317d)

split a domain literal off at the "@" in front of it (25ce9d2)

v4.0.8

4.0.8 (2026-10-17)

Bug Fixes

count inline forwards against the limits of the whole message and a header line for at least 64 bytes (6088bcd)

track the pad of joined base64 encoded words instead of testing the text joined so far (9eb25a6)

v4.0.7

4.0.7 (2026-10-15)

Bug Fixes

bound the addresses inline forwards render with a maxForwardedAddresses option (0bc3c98), closes #111

leave the text after the last > out of the htmlToText link pass (935fdf4), closes #110

... (truncated)

Changelog

Sourced from postal-mime's changelog.

4.0.11 (2026-10-18)

Bug Fixes

read address groups in the same pass as the rest of the list (a951c80)

4.0.10 (2026-10-18)

Bug Fixes

handle an address list without copying it per address (ad33b56)

tokenize addresses into offsets instead of an object per token (1026499)

4.0.9 (2026-10-18)

Bug Fixes

apply the unexpected "<" rule outside quotes and comments (bb2cc7b)

bound group nesting at ten levels (01645e4)

drop the obsolete route from an angle-addr (101d7fb)

end a comment only at the ")" that closes the outermost one (1bd922f)

honour quoted strings and comments inside an angle-addr and a group (005a68a)

never read a mailbox out of a comment (b7681ee)

read CFWS beside the "@" of an addr-spec as nothing (a1475ed)

read the first addr-spec of the display text (db5317d)

split a domain literal off at the "@" in front of it (25ce9d2)

4.0.8 (2026-10-17)

Bug Fixes

count inline forwards against the limits of the whole message and a header line for at least 64 bytes (6088bcd)

track the pad of joined base64 encoded words instead of testing the text joined so far (9eb25a6)

4.0.7 (2026-10-15)

Bug Fixes

bound the addresses inline forwards render with a maxForwardedAddresses option (0bc3c98), closes #111

leave the text after the last > out of the htmlToText link pass (935fdf4), closes #110

unfold format=flowed text in memory that follows its length, not its line count (3894f3c), closes #109

4.0.6 (2026-10-14)

... (truncated)

Commits

3445659 chore(master): release 4.0.11 (#116)

a951c80 fix: read address groups in the same pass as the rest of the list

31f0b30 chore(master): release 4.0.10 (#115)

1026499 fix: tokenize addresses into offsets instead of an object per token

ad33b56 fix: handle an address list without copying it per address

d86960e chore(master): release 4.0.9 (#114)

01645e4 fix: bound group nesting at ten levels

db5317d fix: read the first addr-spec of the display text

b7681ee fix: never read a mailbox out of a comment

101d7fb fix: drop the obsolete route from an angle-addr

Additional commits viewable in compare view

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

[

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• `@dependabot show

Labeled:

October 22, 2026 at 03:10AM

via GitHub https://ift.tt/O1zKRFt

[Oneseco-Media/rsshub]

Bump youtube-caption-extractor from 1.10.2 to 1.10.3

By dependabot[bot]

Assigned to

Bumps youtube-caption-extractor from 1.10.2 to 1.10.3.

Commits

See full diff in compare view

[

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• `@dependabot show

Labeled:

October 22, 2026 at 03:09AM

via GitHub https://ift.tt/DN8mGJj

[Oneseco-Media/rsshub]

Bump imapflow from 2.0.2 to 2.5.5

By dependabot[bot]

Assigned to

Bumps imapflow from 2.0.2 to 2.5.5.

Changelog

Sourced from imapflow's changelog.

2.5.5 (2026-10-18)

Bug Fixes

bump libmime to 5.5.1, libqp to 3.0.1, libbase64 to 1.4.1 and @​zone-eu/mailsplit to 5.4.26 (d5dc4b5)

2.5.4 (2026-10-18)

Bug Fixes

bump @​zone-eu/mailsplit to 5.4.25 (b42e695)

2.5.3 (2026-10-18)

Bug Fixes

bump @​zone-eu/mailsplit to 5.4.24 (ab82e4f)

2.5.2 (2026-10-16)

Bug Fixes

bump @​zone-eu/mailsplit to 5.4.23 (e758c81)

bump libmime to 5.4.9 and libqp to 2.1.3 (0ea7730)

2.5.1 (2026-10-16)

Bug Fixes

bound what a hostile server can make the client buffer or wait for, and keep a tagged BYE from passing as success (9b969a7)

2.5.0 (2026-10-16)

Features

add a transport option and createSocketsTransport() for celld (f4411aa)

add createStreamsTransport() for socket APIs built on web streams (fec7999)

2.4.3 (2026-10-15)

Bug Fixes

fail the command on a NO or BAD status line without a tag (5a38e17)

... (truncated)

Commits

3437cb3 Merge pull request #442 from postalsys/release-please--branches--master--comp...

ad3ffce chore(master): release 2.5.5 [skip-ci]

d5dc4b5 fix: bump libmime to 5.5.1, libqp to 3.0.1, libbase64 to 1.4.1 and @​zone-eu/m...

4742c23 Merge pull request #441 from postalsys/release-please--branches--master--comp...

323e647 chore(master): release 2.5.4 [skip-ci]

b42e695 fix: bump @​zone-eu/mailsplit to 5.4.25

9c76cb4 Merge pull request #440 from postalsys/release-please--branches--master--comp...

d60ef9a chore(master): release 2.5.3 [skip-ci]

ab82e4f fix: bump @​zone-eu/mailsplit to 5.4.24

bdfd4d2 Merge pull request #439 from postalsys/release-please--branches--master--comp...

Additional commits viewable in compare view

[

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• `@dependabot show

Labeled:

October 22, 2026 at 03:09AM

via GitHub https://ift.tt/cuXO8Jq

[Oneseco-Media/rsshub]

Bump rate-limiter-flexible from 11.2.0 to 11.2.3

By dependabot[bot]

Assigned to

Bumps rate-limiter-flexible from 11.2.0 to 11.2.3.

Release notes

Sourced from rate-limiter-flexible's releases.

Redis: call multi only when it will be used

What's Changed

RateLimiterRedis: only call multi when it will be used by @​Page- in animir/node-rate-limiter-flexible#369

New Contributors

@​Page- made their first contribution in animir/node-rate-limiter-flexible#369

Full Changelog: https://github.com/animir/node-rate-limiter-flexible/compare/v11.2.2...v11.2.3

:diamond_shape_with_a_dot_inside:

Queue: fix redundant limiter creation

What's Changed

fix(queue): store the default queue under the 'limiter' key by @​OsamaAnsar in animir/node-rate-limiter-flexible#368

New Contributors

@​OsamaAnsar made their first contribution in animir/node-rate-limiter-flexible#368

Full Changelog: https://github.com/animir/node-rate-limiter-flexible/compare/v11.2.1...v11.2.2

:palm_tree:

Extend types for RateLimiterValkey options

What's Changed

extend IRateLimiterValkeyOptions by rejectIfValkeyNotReady by @​streifehoernli in animir/node-rate-limiter-flexible#367

New Contributors

@​streifehoernli made their first contribution in animir/node-rate-limiter-flexible#367

Full Changelog: https://github.com/animir/node-rate-limiter-flexible/compare/v11.2.0...v11.2.1

:cat:

Commits

d19a457 11.2.3

232d9d5 Merge pull request #369 from balena-io-modules/only-call-multi-when-necessary

5bcb470 RateLimiterRedis: only call multi when it will be used

1a786c8 11.2.2

6b19861 Merge pull request #368 from OsamaAnsar/fix/rate-limiter-queue-default-key

2f7b1b8 fix(queue): store the default queue under the 'limiter' key

1bf9eb1 11.2.1

13f88b4 extend IRateLimiterValkeyOptions by rejectIfValkeyNotReady (#367)

97fd58a update context

See full diff in compare view

[

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• `@dependabot show

Labeled:

October 21, 2026 at 03:13AM

via GitHub https://ift.tt/7rvNkXI

[Oneseco-Media/rsshub]

Bump youtubei.js from 18.0.0 to 18.2.0

By dependabot[bot]

Assigned to

Bumps youtubei.js from 18.0.0 to 18.2.0.

Release notes

Sourced from youtubei.js's releases.

v18.2.0

18.2.0 (2026-10-18)

Features

CompositeVideoPrimaryInfo: Add composite_source_video_primary_info_renderers prop (7be569a)

History: Add support for searching watch history (#1290) (3276daa)

LockupView: Add duration getter (#1303) (447c613)

LockupView: Add styling (#1285) (22103e8)

MediaInfo: Expose publish and upload dates in basic_info (#1274) (6faab8e)

parser: Add CommentImageAttachmentView (#1299) (c01873d)

parser: Add CourseProgressView class (79f7934), closes #917

parser: Add LinearLayoutView class (bdb0797)

parser: Add MenuCustomIconItem class (50883a8), closes #1242

parser: Add PlayerInterstitial and InterstitialView class (#1269) (bad89d2)

parser: Add VideoDescriptionGamingSection class (16f2ed9), closes #1118

parser: Add infocards section nodes (8676d40), closes #730

ShortsLockupView: Add thumbnail_view_model (#1283) (c717f43)

Bug Fixes

Handle missing session config and import Text in ToggleFormField (#1276) (710900a)

LockupMetadataView: Handle missing titles (#1278) (f268ba1)

LockupView: duration getter not working with very long videos (#1306) (cb4a44e)

LockupView: duration parsing large values incorrectly (#1308) (b95ee26)

LockupView: Parser error when content_type is undefined (#1297) (ae4e655)

parser: Add ToggleableListItemView class (#1282) (02c5c8d)

parser: Improve storyboard data parsing (32323cd), closes #671

StructuredDescriptionContent: Add ItemSection type to items (fb801f9)

StructuredDescriptionContent: Add VideoTitleHeaderView type to items (20e3251)

Tab: Add Message type to content (3048496)

Video: is_live getter not working (#1291) (935364f)

v18.1.0

18.1.0 (2026-09-22)

Features

Channel: add methods for show tab (#1260) (d252b36)

GridPlaylist: Add thumbnail_overlays (#1263) (30efa61)

LockupView: Add show as possible content_type (#1262) (2b80e3e)

parser: add 'attributionText' to HowThisWasMadeSectionView (ef3afbe)

parser: Add VideoTitleHeaderView renderer parser (#1238) (e26e13d)

Parser: Add missing /player/heartbeat nodes (#1249) (9b3ee91)

Bug Fixes

... (truncated)

Changelog

Sourced from youtubei.js's changelog.

18.2.0 (2026-10-18)

Features

CompositeVideoPrimaryInfo: Add composite_source_video_primary_info_renderers prop (7be569a)

History: Add support for searching watch history (#1290) (3276daa)

LockupView: Add duration getter (#1303) (447c613)

LockupView: Add styling (#1285) (22103e8)

MediaInfo: Expose publish and upload dates in basic_info (#1274) (6faab8e)

parser: Add CommentImageAttachmentView (#1299) (c01873d)

parser: Add CourseProgressView class (79f7934), closes #917

parser: Add LinearLayoutView class (bdb0797)

parser: Add MenuCustomIconItem class (50883a8), closes #1242

parser: Add PlayerInterstitial and InterstitialView class (#1269) (bad89d2)

parser: Add VideoDescriptionGamingSection class (16f2ed9), closes #1118

parser: Add infocards section nodes (8676d40), closes #730

ShortsLockupView: Add thumbnail_view_model (#1283) (c717f43)

Bug Fixes

Handle missing session config and import Text in ToggleFormField (#1276) (710900a)

LockupMetadataView: Handle missing titles (#1278) (f268ba1)

LockupView: duration getter not working with very long videos (#1306) (cb4a44e)

LockupView: duration parsing large values incorrectly (#1308) (b95ee26)

LockupView: Parser error when content_type is undefined (#1297) (ae4e655)

parser: Add ToggleableListItemView class (#1282) (02c5c8d)

parser: Improve storyboard data parsing (32323cd), closes #671

StructuredDescriptionContent: Add ItemSection type to items (fb801f9)

StructuredDescriptionContent: Add VideoTitleHeaderView type to items (20e3251)

Tab: Add Message type to content (3048496)

Video: is_live getter not working (#1291) (935364f)

18.1.0 (2026-09-22)

Features

Channel: add methods for show tab (#1260) (d252b36)

GridPlaylist: Add thumbnail_overlays (#1263) (30efa61)

LockupView: Add show as possible content_type (#1262) (2b80e3e)

parser: add 'attributionText' to HowThisWasMadeSectionView (ef3afbe)

parser: Add VideoTitleHeaderView renderer parser (#1238) (e26e13d)

Parser: Add missing /player/heartbeat nodes (#1249) (9b3ee91)

Bug Fixes

Format: Rename target_duration_dec to target_duration_sec (0bdd5f1)

... (truncated)

Commits

78375cb chore(main): release 18.2.0 (#1270)

79f7934 feat(parser): Add CourseProgressView class

7be569a feat(CompositeVideoPrimaryInfo): Add `composite_source_video_primary_info_ren...

32323cd fix(parser): Improve storyboard data parsing

8676d40 feat(parser): Add infocards section nodes

16f2ed9 feat(parser): Add VideoDescriptionGamingSection class

50883a8 feat(parser): Add MenuCustomIconItem class

579180e chore(LinearLayoutView): Lint

6dec600 chore(Feed): Fix page_contents return type

bdb0797 feat(parser): Add LinearLayoutView class

Additional commits viewable in compare view

[

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• `@dependabot show

Labeled:

October 21, 2026 at 03:13AM

via GitHub https://ift.tt/7St8HJ6

[Oneseco-Media/rsshub]

Bump re2js from 2.8.6 to 2.8.8

By dependabot[bot]

Assigned to

Bumps re2js from 2.8.6 to 2.8.8.

Release notes

Sourced from re2js's releases.

2.8.8

What's Changed

Bump the actions group with 3 updates by @​dependabot[bot] in le0pard/re2js#61

Bump source-map-js from 1.2.1 to 1.2.2 by @​dependabot[bot] in le0pard/re2js#62

Bump the development group with 4 updates by @​dependabot[bot] in le0pard/re2js#63

DFA now handles \b, \B, ^, $, \A and \z itself, ported from RE2's dfa.cc by @​le0pard in le0pard/re2js#64

Full Changelog: https://github.com/le0pard/re2js/compare/2.8.7...2.8.8

2.8.7

What's Changed

Bump @​vitest/browser from 4.1.9 to 4.1.10 in the npm_and_yarn group across 1 directory by @​dependabot[bot] in le0pard/re2js#50

Bump the npm_and_yarn group across 1 directory with 2 updates by @​dependabot[bot] in le0pard/re2js#51

Migrate runes to Int32Array by @​le0pard in le0pard/re2js#52

Bump postcss from 8.5.15 to 8.5.23 in the npm_and_yarn group across 1 directory by @​dependabot[bot] in le0pard/re2js#53

Bump undici from 6.27.0 to 6.28.0 in the npm_and_yarn group across 1 directory by @​dependabot[bot] in le0pard/re2js#55

Bump nanoid from 3.3.16 to 3.3.18 in the npm_and_yarn group across 1 directory by @​dependabot[bot] in le0pard/re2js#56

Bump undici from 6.28.0 to 6.29.0 in the npm_and_yarn group across 1 directory by @​dependabot[bot] in le0pard/re2js#58

Fix LOOKBEHINDS flag together with any repeated-matching API (matcher().find() in a loop, matchAll(), split(), matcher().replaceAll()) causes quadratic-time by @​le0pard in le0pard/re2js#59

Small security fixes by @​le0pard in le0pard/re2js#60

Full Changelog: https://github.com/le0pard/re2js/compare/2.8.6...2.8.7

Commits

85bb856 bump version

ea55e9a Merge pull request #64 from le0pard/dfa-cover-boundaries

72d5d61 improve folding

8bd5f02 add more tests and fixes

908c204 add more tests and fixes

4c8c1a2 DFA now handles \b, \B, ^, $, \A and \z itself, ported from RE2's dfa.cc

6d3533f update alternatives

d289052 update benchmarks

6d0e35d add re2 for bench

6de8f09 fix tsconfig

Additional commits viewable in compare view

[

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• `@dependabot show

Labeled:

October 21, 2026 at 03:12AM

via GitHub https://ift.tt/fwP96Ut

[Oneseco-Media/rsshub]

Bump google-play-scraper from 10.1.3 to 10.1.4

By dependabot[bot]

Assigned to

Bumps google-play-scraper from 10.1.3 to 10.1.4.

Commits

27d6af0 10.1.4

c19665c fix audit

c85f3e9 conditional preview video in test

ed4df8c reviews: update the request to the current oCPfdb RPCReview improvements (#769)

20359f6 fix: undefined description error #582 (#757)

04b50e8 Fix CI (#767)

935206a fix audit

583c225 Bump brace-expansion from 1.1.12 to 1.1.21 (#764)

b6de856 Bump js-yaml from 4.1.1 to 4.3.2 (#765)

e942ef1 Bump serialize-javascript and mocha (#763)

Additional commits viewable in compare view

[

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• `@dependabot show

Labeled:

October 21, 2026 at 03:11AM

via GitHub https://ift.tt/mRNpiyM

[Oneseco-Media/rsshub]

Bump postal-mime from 3.0.0 to 4.0.8

By dependabot[bot]

Assigned to

Bumps postal-mime from 3.0.0 to 4.0.8.

Release notes

Sourced from postal-mime's releases.

v4.0.8

4.0.8 (2026-10-17)

Bug Fixes

count inline forwards against the limits of the whole message and a header line for at least 64 bytes (6088bcd)

track the pad of joined base64 encoded words instead of testing the text joined so far (9eb25a6)

v4.0.7

4.0.7 (2026-10-15)

Bug Fixes

bound the addresses inline forwards render with a maxForwardedAddresses option (0bc3c98), closes #111

leave the text after the last > out of the htmlToText link pass (935fdf4), closes #110

unfold format=flowed text in memory that follows its length, not its line count (3894f3c), closes #109

v4.0.6

4.0.6 (2026-10-14)

Bug Fixes

hold base64 output in fixed size chunks instead of one buffer per padded unit (6de2c8b), closes #107

v4.0.5

4.0.5 (2026-10-07)

Bug Fixes

bound the number of MIME parts with a maxPartCount option (87eaedd)

convert html with many unclosed link tags to text in linear time (c8e5792)

decode uppercase hex, NUL and C1 numeric character references like a browser (ee12306)

delete the trailing white space of quoted-printable lines (0639c5e)

end the headers at a whitespace-only line when no header can follow it (0639c5e)

fold line breaks out of decoded encoded words and RFC 2231 filenames (1f25e26)

hand attachment bytes through as sent and read legacy mail the lax way (0639c5e)

keep an escaped parenthesis inside an RFC 5322 comment (a2a07ce)

keep the line endings of 7bit, 8bit and binary parts and normalize text to LF (0639c5e)

read a multipart without a boundary parameter as plain text (0639c5e)

read text without a usable charset as UTF-8 or windows-1252 and honor an html meta charset (0639c5e)

unfold format=flowed quoted paragraphs as RFC 3676 reads them (0639c5e)

v4.0.4

4.0.4 (2026-10-03)

... (truncated)

Changelog

Sourced from postal-mime's changelog.

4.0.8 (2026-10-17)

Bug Fixes

count inline forwards against the limits of the whole message and a header line for at least 64 bytes (6088bcd)

track the pad of joined base64 encoded words instead of testing the text joined so far (9eb25a6)

4.0.7 (2026-10-15)

Bug Fixes

bound the addresses inline forwards render with a maxForwardedAddresses option (0bc3c98), closes #111

leave the text after the last > out of the htmlToText link pass (935fdf4), closes #110

unfold format=flowed text in memory that follows its length, not its line count (3894f3c), closes #109

4.0.6 (2026-10-14)

Bug Fixes

hold base64 output in fixed size chunks instead of one buffer per padded unit (6de2c8b), closes #107

4.0.5 (2026-10-07)

Bug Fixes

bound the number of MIME parts with a maxPartCount option (87eaedd)

convert html with many unclosed link tags to text in linear time (c8e5792)

decode uppercase hex, NUL and C1 numeric character references like a browser (ee12306)

delete the trailing white space of quoted-printable lines (0639c5e)

end the headers at a whitespace-only line when no header can follow it (0639c5e)

fold line breaks out of decoded encoded words and RFC 2231 filenames (1f25e26)

hand attachment bytes through as sent and read legacy mail the lax way (0639c5e)

keep an escaped parenthesis inside an RFC 5322 comment (a2a07ce)

keep the line endings of 7bit, 8bit and binary parts and normalize text to LF (0639c5e)

read a multipart without a boundary parameter as plain text (0639c5e)

read text without a usable charset as UTF-8 or windows-1252 and honor an html meta charset (0639c5e)

unfold format=flowed quoted paragraphs as RFC 3676 reads them (0639c5e)

4.0.4 (2026-10-03)

Bug Fixes

stop decoding the CRLF before a multipart boundary as part content (004eec7), closes #102

4.0.3 (2026-10-03)

... (truncated)

Commits

fd4d0a5 chore(master): release 4.0.8 (#113)

4f5e1bf test: compare the parse costs of the scaling test per byte with room for the ...

82e20ee test: raise the heap limit of the scaling test to what the address parser needs

3504a6b test: measure the parse cost of every input shape at two sizes and under a he...

6088bcd fix: count inline forwards against the limits of the whole message and a head...

9eb25a6 fix: track the pad of joined base64 encoded words instead of testing the text...

abfee49 chore(master): release 4.0.7 (#112)

7d956c9 chore: update dependencies

0bc3c98 fix: bound the addresses inline forwards render with a maxForwardedAddresses ...

935fdf4 fix: leave the text after the last > out of the htmlToText link pass

Additional commits viewable in compare view

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

[

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• `@dependabot show

Labeled:

October 21, 2026 at 03:10AM

via GitHub https://ift.tt/plT9FWz

[Oneseco-Media/rsshub]

Bump eslint-plugin-n from 18.3.0 to 18.5.0

By dependabot[bot]

Assigned to

Bumps eslint-plugin-n from 18.3.0 to 18.5.0.

Release notes

Sourced from eslint-plugin-n's releases.

v18.5.0

18.5.0 (2026-10-18)

🌟 Features

node-builtins: ✨ support 20.20, 22.23, 24.22 and 26.12 (#578) (2fa0069)

🩹 Fixes

no-mixed-requires: classify modern Node built-ins (#580) (58c5d56)

no-unsupported-features/es-syntax: Promise.withResolvers is supported since Node.js 22.0.0 (#577) (4a6dee1)

📚 Documentation

explain module aliases for no-missing-require (#579) (fcf1256)

v18.4.1

18.4.1 (2026-10-03)

🩹 Fixes

prefer-promises/fs: cover fs.watch (#566) (37bf3a2)

properly handle extension override mappings in file-extension-in-import (#572) (995c881)

🧹 Chores

cache parsed tsconfig per directory (#571) (1cfd694)

Remove stale TypeScript suppressions blocking the Lint job (#574) (73f4d4f)

resolve import targets lazily and reuse resolvers (#570) (aff82d1)

v18.4.0

18.4.0 (2026-09-26)

🌟 Features

no-extraneous: Support pnpm workspaces in no-extraneous rules (#569) (3aae430)

📚 Documentation

fix broken documentation links (#567) (569153f)

Changelog

Sourced from eslint-plugin-n's changelog.

18.5.0 (2026-10-18)

🌟 Features

node-builtins: ✨ support 20.20, 22.23, 24.22 and 26.12 (#578) (2fa0069)

🩹 Fixes

no-mixed-requires: classify modern Node built-ins (#580) (58c5d56)

no-unsupported-features/es-syntax: Promise.withResolvers is supported since Node.js 22.0.0 (#577) (4a6dee1)

📚 Documentation

explain module aliases for no-missing-require (#579) (fcf1256)

18.4.1 (2026-10-03)

🩹 Fixes

prefer-promises/fs: cover fs.watch (#566) (37bf3a2)

properly handle extension override mappings in file-extension-in-import (#572) (995c881)

🧹 Chores

cache parsed tsconfig per directory (#571) (1cfd694)

Remove stale TypeScript suppressions blocking the Lint job (#574) (73f4d4f)

resolve import targets lazily and reuse resolvers (#570) (aff82d1)

18.4.0 (2026-09-26)

🌟 Features

no-extraneous: Support pnpm workspaces in no-extraneous rules (#569) (3aae430)

📚 Documentation

fix broken documentation links (#567) (569153f)

Commits

5bbe603 chore(master): release 18.5.0 (#581)

2fa0069 feat(node-builtins): ✨ support 20.20, 22.23, 24.22 and 26.12 (#578)

fcf1256 docs: explain module aliases for no-missing-require (#579)

58c5d56 fix(no-mixed-requires): classify modern Node built-ins (#580)

4a6dee1 fix(no-unsupported-features/es-syntax): Promise.withResolvers is supported si...

f1d47af chore(master): release 18.4.1 (#573)

73f4d4f chore: Remove stale TypeScript suppressions blocking the Lint job (#574)

37bf3a2 fix(prefer-promises/fs): cover fs.watch (#566)

aff82d1 perf: resolve import targets lazily and reuse resolvers (#570)

1cfd694 perf: cache parsed tsconfig per directory (#571)

Additional commits viewable in compare view

[

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• `@dependabot show

Labeled:

October 21, 2026 at 03:10AM

via GitHub https://ift.tt/6bWKDE1

[Oneseco-Media/oneseco-org-restructure]

Action log: Notion development indexing and consolidation — 2026-10-21

By Cybersoulja

Assigned to

Recorded actions — 2026-10-21

Consolidated Notion development navigation and project indexing. This records completed documentation/organization work; physical source-database migration remains unfinished.

Completed

• Audited 35 related character-generator data sources and wrote a consolidation plan.
• Created the Phaser research collection with the original 86-entry source directory and five supporting files.
• Ran 21 targeted Notion development searches.
• Indexed 2,734 distinct Notion page IDs, including metadata for 1,760 documents, 417 imported issues and 63 sprint items.
• Added 18 source-linked project records to the existing Project OS Projects database.
• Linked the consolidated directory from the existing Oneseco-Media GitHub Development Hub while preserving its NOW/NEXT priorities.
• Created project next-action, source-directory and duplicate/decision documentation.
• Recorded three matching repository-catalog pairs and four source-linked historical summaries.
• Uploaded six CSV index parts, a report and readme to the development evidence folder; verified all eight files and the 18 unique project records.

Evidence

• Notion action log
• All Development — Consolidated Projects & Knowledge
• Project registry
• Development Systems & Source Directory
• Duplicates, Snapshots & Consolidation Decisions
• Development evidence files
• Phaser research collection
• 35-source consolidation plan

Scope and limits

The inventory combines fetched sources, metadata-only records, linked children and search candidates; it is not an exhaustive workspace export or a page-body backup. Six generator wiki inventories remain partial. Repeated titles, including 1,660 Task List and 85 Daily Note records, were not treated as proof of duplicate content.

No original source databases were physically merged, deleted or archived. This work did not alter runtime code, deployments, credentials, repository permissions or existing cleanup-issue status. The Phaser game module is still unimplemented.

Remaining work, not completed by this action

1. Finish wiki exports and resolve the missing linked Character Sheet source.
2. Snapshot properties, page bodies, attachments and relations.
3. Compare candidate duplicates, preserve unique content and establish source-to-survivor IDs.
4. Run reversible migration batches and validate references before retiring sources.
5. Implement and test the Phaser Notion integration and idempotent confirmed-character saves.

Related organizational context: #11 and #12 cover repository consolidation. This action log does not claim those issues have been executed or resolved.

Labeled:

October 21, 2026 at 01:36AM

via GitHub https://ift.tt/NYbdQZ1

[Oneseco-Media/rsshub]

Bump imapflow from 2.0.2 to 2.5.2

By dependabot[bot]

Assigned to

Bumps imapflow from 2.0.2 to 2.5.2.

Changelog

Sourced from imapflow's changelog.

2.5.2 (2026-10-16)

Bug Fixes

bump @​zone-eu/mailsplit to 5.4.23 (e758c81)

bump libmime to 5.4.9 and libqp to 2.1.3 (0ea7730)

2.5.1 (2026-10-16)

Bug Fixes

bound what a hostile server can make the client buffer or wait for, and keep a tagged BYE from passing as success (9b969a7)

2.5.0 (2026-10-16)

Features

add a transport option and createSocketsTransport() for celld (f4411aa)

add createStreamsTransport() for socket APIs built on web streams (fec7999)

2.4.3 (2026-10-15)

Bug Fixes

fail the command on a NO or BAD status line without a tag (5a38e17)

send ID after STARTTLS instead of before it (7d6f37a)

send ID after STARTTLS instead of before it (197ecdc)

2.4.2 (2026-10-14)

Bug Fixes

deps: update libmime to 5.4.8 and mailsplit to 5.4.21 (8eafb46)

2.4.1 (2026-10-14)

Bug Fixes

download: bump libbase64 to decode padded base64 parts in linear memory (1c83261)

2.4.0 (2026-10-10)

Features

... (truncated)

Commits

bdfd4d2 Merge pull request #439 from postalsys/release-please--branches--master--comp...

8fc1944 chore(master): release 2.5.2 [skip-ci]

e758c81 fix: bump @​zone-eu/mailsplit to 5.4.23

0ea7730 fix: bump libmime to 5.4.9 and libqp to 2.1.3

766e7ab Merge pull request #438 from postalsys/release-please--branches--master--comp...

c229b1e chore(master): release 2.5.1 [skip-ci]

9b969a7 fix: bound what a hostile server can make the client buffer or wait for, and ...

bb0152e Merge pull request #436 from postalsys/release-please--branches--master--comp...

a4043c0 chore: drop the duplicate 2.5.0 changelog entry [skip ci]

f50b210 chore(master): release 2.5.0 [skip-ci]

Additional commits viewable in compare view

[

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• `@dependabot show

Labeled:

October 20, 2026 at 03:10AM

via GitHub https://ift.tt/Uq1LwlE

[Oneseco-Media/rsshub]

Bump @notionhq/client from 5.26.0 to 5.27.1

By dependabot[bot]

Assigned to

Bumps @notionhq/client from 5.26.0 to 5.27.1.

Release notes

Sourced from @​notionhq/client's releases.

v5.27.1

What’s changed

Bug fixes

Cloudflare Workers and Deno workers are no longer treated as browsers (#809)

Since v5.27.0, creating a client with auth in Cloudflare Workers or a Deno worker thread threw BrowserTokenNotAllowedError, and the client stopped sending its user-agent header there. Both work again.

A worker now counts as a browser only when its global object is an instance of WorkerGlobalScope and it has an importScripts function. Browser pages, web workers, shared workers, and service workers are still blocked.

If you added dangerouslyAllowBrowser: true as a workaround on a server runtime, you can remove it.

Internals

The version bump workflow checks contract changes against the last release tag, so a reviewed type change can merge before its minor release without landing in a patch (#807).

Links

Full Changelog: https://github.com/makenotion/notion-sdk-js/compare/v5.27.0...v5.27.1

NPM Package: https://www.npmjs.com/package/@​notionhq/client/v/5.27.1

v5.27.0

What’s changed

Behavior changes

Tokens are blocked in browsers by default (#791)

In a browser page, web worker, or service worker, constructing a client with auth throws BrowserTokenNotAllowedError. Per-request auth and OAuth client credentials reject with the same error before anything is sent. Anyone who can load the page can read the token and act as the connection.

Pass dangerouslyAllowBrowser: true to opt out, for example in jsdom tests. A client without a token still works in a browser, such as one whose baseUrl points at your own server. See the README's "Browser usage" section.

New capabilities

Agent Skills API (#804)

Adds client.plugins.list(), client.plugins.retrieve(), and client.skills.retrieve(). The retrieve methods return a signed archive URL. They don't download or extract files.

Typed databases (#790)

client.databases.create() accepts database_type of tasks, projects, or skills. Database and data source responses include a read-only database_type.

API response types

These changes match what the Agents API (public beta) returns today. Code that matched the old literals needs a small update.

Personal agent ID is notion_ai (#806, from #774)

Agent response IDs can be notion_ai. The personal agent in QueryAgentsResponse has id: "notion_ai" instead of 33333333-3333-3333-3333-333333333333. Requests still accept the old UUID.

Personal agent insights (#806, from #780)

client.agents.retrieveInsights() responses allow notion_ai for id and agent_type.

Personal agent name is a string (#806, from #803)

Owners can rename their personal agent, so it's no longer always "Notion Agent".

stream.end has no last_sequence (#806, from #773)

The API stopped sending it. Resume with event IDs.

Session stream events are generated (#786). Event shapes are unchanged.

Docs and internals

... (truncated)

Commits

0ffdbba Bump version to v5.27.1 (#811)

3cf7286 Stop treating Cloudflare Workers and Deno workers as browsers (#809)

37d6d24 Allow reviewed contract changes before their minor release (#807)

25a755e Bump version to v5.27.0 (#806)

37025ab [AI] Add doc comments to property discriminators in Query sessions filter p...

ebd7740 [AI] Document empty bounded pages in query sessions response (#788)

a641494 [AI] Remove redacted tool-call input/output/error fields and update `ve...

c996c38 Block Notion tokens in a browser unless dangerouslyAllowBrowser is set (#791)

5126811 [SDK] Add typed Skills and plugin directory methods (#804)

978d690 [AI] Update Create file upload parameter doc comments (#796)

Additional commits viewable in compare view

[

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• `@dependabot show

Labeled:

October 20, 2026 at 03:09AM

via GitHub https://ift.tt/MBZ7JFp