Oneseco Media GITHUB

[Oneseco-Media/rsshub]

Bump @honeybadger-io/js from 6.16.3 to 6.17.0

By dependabot[bot]

Assigned to

Bumps @honeybadger-io/js from 6.16.3 to 6.17.0.

Release notes

Sourced from @​honeybadger-io/js's releases.

@​honeybadger-io/js@​6.17.0

6.17.0 (2026-10-16)

Features

core: add beforeBreadcrumb hook (#1678) (bda6dcd)

@​honeybadger-io/js@​6.16.6

6.16.6 (2026-10-08)

Bug Fixes

core: apply filters to query strings wherever a URL is reported (#1677) (d49aec8)

@​honeybadger-io/js@​6.16.5

6.16.5 (2026-09-27)

Bug Fixes

share the js singleton across duplicate module copies (#1670) (39f94ca)

@​honeybadger-io/js@​6.16.4

6.16.4 (2026-09-22)

Note: Version bump only for package @​honeybadger-io/js

Commits

7941f49 chore(release): publish [skip ci]

bda6dcd feat(core): add beforeBreadcrumb hook (#1678)

4e92061 chore(release): publish [skip ci]

d49aec8 fix(core): apply filters to query strings wherever a URL is reported (#1677)

03f1158 chore(release): publish [skip ci]

a18c086 feat(nextjs): support Turbopack via Next.js instrumentation and post-compile ...

a03a364 chore(release): publish [skip ci]

1c55d14 fix(react-native): send pre-serialized events batches without re-encoding (#1...

e29582c chore(release): publish [skip ci]

39f94ca fix: share the js singleton across duplicate module copies (#1670)

Additional commits viewable in compare view

[

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• `@dependabot show

Labeled:

October 20, 2026 at 03:09AM

via GitHub https://ift.tt/mucwlnX

[Oneseco-Media/mindbridge-app]

Build MindBridge guided practice, coaching, and replay

By SapphireBaby

Assigned to

Replace the mounted generic scenario prototype with a responsive conversation studio centered on the supervisor/Jordan attendance exercise. Users respond in their own words across four moments, pause for examples, receive feedback quoting their response, replay each moment, and compare attempts in a copyable recap.

This is explicitly labeled scripted guided practice with local pattern checks, not live AI or validated EQ scoring. Sessions remain in memory and are cleared by refresh or exit. Existing legacy scenario components remain unmounted. README now describes the actual implementation and the next server-side AI milestone.

Validation: npm test passes all 6 checks; npm run build passes. CI now runs tests before building. Browser interaction/visual QA could not run because the environment has no installed Playwright browser; this remains outstanding before release.

No production deployment or main-branch merge performed.

Labeled:

October 19, 2026 at 11:13PM

via GitHub https://ift.tt/WwGUz8o

[Cybersoulja/trill-local-runtime]

feat(gumroad): add agent skill for store setup, copy, and research

By Cybersoulja

Assigned to

Summary

• Adds gumroad-agent-skill/: stdlib-only (Python 3.9+) skill for Gumroad store overview, draft product creation, page-copy drafting, and pricing/keyword research.
• Permission tiers: autonomous (overview, sales, draft_copy, research, create_draft) vs. gated, requiring --confirm (publish, set_price). create_draft is always unpublished.
• Token read from GUMROAD_ACCESS_TOKEN only (use keychain-env run). ANTHROPIC_API_KEY is optional; copy falls back to a deterministic template.

Caveats

• Gumroad's public API is not confirmed to support product creation. create_draft returns a manual checklist on 404/405.
• Not exercised against the live Gumroad API; unit tests use a fake transport.

Test plan

• python3 -m unittest discover -s tests -t . (10 tests pass)
• Run overview and create_draft with a real token

Labeled:

October 19, 2026 at 09:38PM

via GitHub https://ift.tt/fd6aW8D

[Oneseco-Media/rsshub]

Bump undici from 8.10.2 to 8.12.2

By dependabot[bot]

Assigned to

Bumps undici from 8.10.2 to 8.12.2.

Release notes

Sourced from undici's releases.

v8.12.2

Security fixes

High severity

Denial of service via TLS 1.2 certificate-changing renegotiation

CVE-2026-87018 · GHSA-qrxm-fqhp-jwvm

A malicious or compromised HTTPS server could crash the Node.js process by initiating TLS 1.2 renegotiation and presenting a different, CA-trusted certificate whose hostname did not match the requested host. The resulting socket error reached an assertion in undici's HTTP/1.1 and HTTP/2 connection handling. This release handles post-connect certificate errors without terminating the process.

TLS certificate validation bypass through dropped Agent options

CVE-2026-109383 · GHSA-2m5v-pch6-74hx

Agent used a JSON-based clone for constructor options, which silently removed function-valued TLS options such as checkServerIdentity. Applications relying on custom certificate or public-key verification could therefore accept a certificate that the callback was intended to reject. This release preserves TLS options when creating per-origin dispatchers.

Cache poisoning and cross-user disclosure through cross-origin redirects

CVE-2026-109829 · GHSA-4w7w-5xrc-9h26

When an originless Agent combined redirect and shared-cache interceptors as compose(redirect(), cache()), a response from a cross-origin redirect could be stored under the original URL. This could allow persistent cache poisoning or disclosure of user-specific responses to later callers. This release verifies the response origin before caching and preserves redirect-hop cache-control policy.

Denial of service through excessive Content-Encoding values

CVE-2026-109869 · GHSA-xjj6-f33q-929c

A malicious HTTP server could crash the Node.js process by returning more than five content codings and closing the connection before sending the body. Although fetch() rejected the response, an error from an orphaned internal stream could remain unhandled. This release validates the content-encoding chain before creating the body stream and aborts oversized chains safely.

Medium severity

Denial of service through the decompress interceptor

CVE-2026-87029 · GHSA-55wc-3pg8-jfw6

An exception thrown by a downstream response handler from an asynchronous decompression callback could escape as an uncaught exception. A server could trigger this when decompress was composed with a handler such as dump with a size limit. This release converts downstream handler exceptions into per-request errors.

Subresource Integrity bypass with non-lowercase algorithm tokens

CVE-2026-109841 · GHSA-f72v-6w45-q472

fetch() treated valid mixed-case or uppercase SRI algorithm tokens, such as SHA256, as unknown and could accept a response whose body did not match the configured digest. This release normalizes algorithm tokens before validation and digest selection.

Denial of service through unbounded EventSource parser state

CVE-2026-109924 · GHSA-4qv8-2p9j-2685

A malicious Server-Sent Events endpoint could exhaust process memory by sending many tiny data: fields without completing an event, or by splitting an unfinished line across many chunks. This release bounds retained EventSource parser state, including field counts, buffered chunks, unfinished-line length, and retained field data.

... (truncated)

Commits

bb6cc0a Bumped v8.12.2 (#6021)

b217373 fix(websocket): bound automatic PONG writes under backpressure

789ef26 fix(eventsource): bound retained SSE parser state

4f7ef68 fix(sri): accept non-lowercase algorithm tokens

f851f31 fix(decompress): converge downstream handler throws to per-request errors

b5084c7 fix(fetch): abort excessive content encoding responses

26c2bfb fix(cache): prevent cross-origin redirect cache confusion

f75eac0 fix: preserve Agent connection options

e257e9f fix: handle post-connect TLS certificate errors

a65ec32 Bumped v8.12.1 (#6010)

Additional commits viewable in compare view

[

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• `@dependabot show

Labeled:

October 19, 2026 at 03:21AM

via GitHub https://ift.tt/kEVGJtR

[Oneseco-Media/rsshub]

Bump postal-mime from 3.0.0 to 4.0.7

By dependabot[bot]

Assigned to

Bumps postal-mime from 3.0.0 to 4.0.7.

Release notes

Sourced from postal-mime's releases.

v4.0.7

4.0.7 (2026-10-15)

Bug Fixes

bound the addresses inline forwards render with a maxForwardedAddresses option (0bc3c98), closes #111

leave the text after the last > out of the htmlToText link pass (935fdf4), closes #110

unfold format=flowed text in memory that follows its length, not its line count (3894f3c), closes #109

v4.0.6

4.0.6 (2026-10-14)

Bug Fixes

hold base64 output in fixed size chunks instead of one buffer per padded unit (6de2c8b), closes #107

v4.0.5

4.0.5 (2026-10-07)

Bug Fixes

bound the number of MIME parts with a maxPartCount option (87eaedd)

convert html with many unclosed link tags to text in linear time (c8e5792)

decode uppercase hex, NUL and C1 numeric character references like a browser (ee12306)

delete the trailing white space of quoted-printable lines (0639c5e)

end the headers at a whitespace-only line when no header can follow it (0639c5e)

fold line breaks out of decoded encoded words and RFC 2231 filenames (1f25e26)

hand attachment bytes through as sent and read legacy mail the lax way (0639c5e)

keep an escaped parenthesis inside an RFC 5322 comment (a2a07ce)

keep the line endings of 7bit, 8bit and binary parts and normalize text to LF (0639c5e)

read a multipart without a boundary parameter as plain text (0639c5e)

read text without a usable charset as UTF-8 or windows-1252 and honor an html meta charset (0639c5e)

unfold format=flowed quoted paragraphs as RFC 3676 reads them (0639c5e)

v4.0.4

4.0.4 (2026-10-03)

Bug Fixes

stop decoding the CRLF before a multipart boundary as part content (004eec7), closes #102

v4.0.3

4.0.3 (2026-10-03)

Bug Fixes

... (truncated)

Changelog

Sourced from postal-mime's changelog.

4.0.7 (2026-10-15)

Bug Fixes

bound the addresses inline forwards render with a maxForwardedAddresses option (0bc3c98), closes #111

leave the text after the last > out of the htmlToText link pass (935fdf4), closes #110

unfold format=flowed text in memory that follows its length, not its line count (3894f3c), closes #109

4.0.6 (2026-10-14)

Bug Fixes

hold base64 output in fixed size chunks instead of one buffer per padded unit (6de2c8b), closes #107

4.0.5 (2026-10-07)

Bug Fixes

bound the number of MIME parts with a maxPartCount option (87eaedd)

convert html with many unclosed link tags to text in linear time (c8e5792)

decode uppercase hex, NUL and C1 numeric character references like a browser (ee12306)

delete the trailing white space of quoted-printable lines (0639c5e)

end the headers at a whitespace-only line when no header can follow it (0639c5e)

fold line breaks out of decoded encoded words and RFC 2231 filenames (1f25e26)

hand attachment bytes through as sent and read legacy mail the lax way (0639c5e)

keep an escaped parenthesis inside an RFC 5322 comment (a2a07ce)

keep the line endings of 7bit, 8bit and binary parts and normalize text to LF (0639c5e)

read a multipart without a boundary parameter as plain text (0639c5e)

read text without a usable charset as UTF-8 or windows-1252 and honor an html meta charset (0639c5e)

unfold format=flowed quoted paragraphs as RFC 3676 reads them (0639c5e)

4.0.4 (2026-10-03)

Bug Fixes

stop decoding the CRLF before a multipart boundary as part content (004eec7), closes #102

4.0.3 (2026-10-03)

Bug Fixes

keep a continuation from overriding the plain parameter of the same name (6fa92ad)

stop the junk behind a closed quoted string from hiding the whole body (535fcf8)

4.0.2 (2026-09-30)

... (truncated)

Commits

abfee49 chore(master): release 4.0.7 (#112)

7d956c9 chore: update dependencies

0bc3c98 fix: bound the addresses inline forwards render with a maxForwardedAddresses ...

935fdf4 fix: leave the text after the last > out of the htmlToText link pass

3894f3c fix: unfold format=flowed text in memory that follows its length, not its lin...

8e7eac1 chore(master): release 4.0.6 (#108)

6de2c8b fix: hold base64 output in fixed size chunks instead of one buffer per padded...

16a157b chore(master): release 4.0.5 (#106)

a2a07ce fix: keep an escaped parenthesis inside an RFC 5322 comment

472121f test: compare the windows-1252 fallback with the runtime's own decoder

Additional commits viewable in compare view

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

[

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• `@dependabot show

Labeled:

October 19, 2026 at 03:20AM

via GitHub https://ift.tt/8eGstZw

[Oneseco-Media/rsshub]

Bump @sentry/node from 10.74.0 to 11.8.0

By dependabot[bot]

Assigned to

Bumps @sentry/node from 10.74.0 to 11.8.0.

Release notes

Sourced from @​sentry/node's releases.

11.8.0

Important Changes

feat(bundler-plugins): Release @sentry/webpack-plugin, @sentry/vite-plugin, @sentry/rollup-plugin and @sentry/esbuild-plugin from the SDK repository (#25095)

The four standalone bundler plugins now release together with the SDK, so their version jumps from 5.4.1 to the SDK version. Each package re-exports the matching @sentry/bundler-plugins entry point, which we recommend for new projects. The plugin options do not change, but the update brings these breaking changes:

Node.js 20.19.0 or higher is required.

@sentry/webpack-plugin requires webpack 5.1 or higher. The @sentry/webpack-plugin/webpack5 entry point still works and exports the same plugin as @sentry/webpack-plugin.

The plugins use the sentry CLI SDK instead of @sentry/cli. Sentry self-hosted 26.4.2 or higher is supported. Lower versions may continue to work.

Deploys that the plugins create on Vercel use the value of VERCEL_TARGET_ENV (production, preview or a custom name) as their environment, instead of vercel-production or vercel-preview. To keep the old value, set release.deploy.env.

feat(server-utils): Instrument the OpenAI decisions API as gen_ai.decide spans (#25285)

OpenAI decisions.create calls now create gen_ai.decide spans.

Other Changes

feat(core): Support SuppressedError in LinkedErrors integration (#25246)

fix(astro): Delete generated source maps for static output (#25310)

fix(astro): Upload source maps of Astro 7's prerender build (#25309)

fix(browser): Apply urlQueryParams to the Referer header (#25324)

fix(cloudflare): auto-instrument when wrangler main is a package (#25343)

fix(hono): Expose runtime-specific SDK options (#25290)

fix(node): Instrument Prisma 8 CollectionBase from rc.15 (#25301)

fix(nuxt): Skip 3xx/4xx Nuxt errors in the vue:error hook (#25341)

fix(server-utils): Read pi-durable 1.2.0 tool results from output (#25312)

fix(server-utils): Transform modules once when two Sentry Vite plugins add orchestrion (#25043)

fix(sveltekit): add op and origin to Kit's sveltekit.endpoint span (#25376)

fix(tanstackstart-react): Keep parametrized route names in Nitro 3 builds (#25307)

fix(tanstackstart-react): Rewrite source paths of split route modules (#25361)

chore: Add external contributor to CHANGELOG.md (#25375)

ci: Install the pnpm version that Volta pins (#25287)

license: Add cli FSL notice to package licenses (#25314)

ref(core): use shared MCP attribute conventions (#25059)

ref(tanstackstart-react): Reuse shared component annotation options (#25313)

test(browser): Keep whitespace text out of the handlers-lcp page (#25280)

test(bun): Restore @​sentry/core spies after the Bun.serve tests (#25276)

test(bundler-plugins): Disable CLI telemetry in the CLI contract tests (#25308)

test(e2e): Add node-openai-decisions-send-to-sentry test app (#25331)

test(e2e): Add node-openai-send-to-sentry test app (#24824)

test(e2e): Add nuxt-5-sourcemaps test (#25268)

test(e2e): Inherit root Volta config in all e2e test apps (#25369)

test(e2e): Use an external host address for the Lambda DSN on loopback hostnames (#25282)

test(nextjs): Run nextjs-16-tunnel on Cloudflare (#25161)

test(nextjs): Switch DEBUG_BUILD with a getter instead of re-importing the SDK (#25279)

... (truncated)

Changelog

Sourced from @​sentry/node's changelog.

11.8.0

Important Changes

feat(bundler-plugins): Release @sentry/webpack-plugin, @sentry/vite-plugin, @sentry/rollup-plugin and @sentry/esbuild-plugin from the SDK repository (#25095)

The four standalone bundler plugins now release together with the SDK, so their version jumps from 5.4.1 to the SDK version. Each package re-exports the matching @sentry/bundler-plugins entry point, which we recommend for new projects. The plugin options do not change, but the update brings these breaking changes:

Node.js 20.19.0 or higher is required.

@sentry/webpack-plugin requires webpack 5.1 or higher. The @sentry/webpack-plugin/webpack5 entry point still works and exports the same plugin as @sentry/webpack-plugin.

The plugins use the sentry CLI SDK instead of @sentry/cli. Sentry self-hosted 26.4.2 or higher is supported. Lower versions may continue to work.

Deploys that the plugins create on Vercel use the value of VERCEL_TARGET_ENV (production, preview or a custom name) as their environment, instead of vercel-production or vercel-preview. To keep the old value, set release.deploy.env.

feat(server-utils): Instrument the OpenAI decisions API as gen_ai.decide spans (#25285)

OpenAI decisions.create calls now create gen_ai.decide spans.

Other Changes

feat(core): Support SuppressedError in LinkedErrors integration (#25246)

fix(astro): Delete generated source maps for static output (#25310)

fix(astro): Upload source maps of Astro 7's prerender build (#25309)

fix(browser): Apply urlQueryParams to the Referer header (#25324)

fix(cloudflare): auto-instrument when wrangler main is a package (#25343)

fix(hono): Expose runtime-specific SDK options (#25290)

fix(node): Instrument Prisma 8 CollectionBase from rc.15 (#25301)

fix(nuxt): Skip 3xx/4xx Nuxt errors in the vue:error hook (#25341)

fix(server-utils): Read pi-durable 1.2.0 tool results from output (#25312)

fix(server-utils): Transform modules once when two Sentry Vite plugins add orchestrion (#25043)

fix(sveltekit): add op and origin to Kit's sveltekit.endpoint span (#25376)

fix(tanstackstart-react): Keep parametrized route names in Nitro 3 builds (#25307)

fix(tanstackstart-react): Rewrite source paths of split route modules (#25361)

chore: Add external contributor to CHANGELOG.md (#25375)

ci: Install the pnpm version that Volta pins (#25287)

license: Add cli FSL notice to package licenses (#25314)

ref(core): use shared MCP attribute conventions (#25059)

ref(tanstackstart-react): Reuse shared component annotation options (#25313)

test(browser): Keep whitespace text out of the handlers-lcp page (#25280)

test(bun): Restore @​sentry/core spies after the Bun.serve tests (#25276)

test(bundler-plugins): Disable CLI telemetry in the CLI contract tests (#25308)

test(e2e): Add node-openai-decisions-send-to-sentry test app (#25331)

test(e2e): Add node-openai-send-to-sentry test app (#24824)

test(e2e): Add nuxt-5-sourcemaps test (#25268)

test(e2e): Inherit root Volta config in all e2e test apps (#25369)

test(e2e): Use an external host address for the Lambda DSN on loopback hostnames (#25282)

test(nextjs): Run nextjs-16-tunnel on Cloudflare (#25161)

... (truncated)

Commits

c6492ef release: 11.8.0

e091f7f meta(changelog): Update changelog for 11.8.0 (#25388)

30ec754 meta(changelog): Update changelog for 11.8.0

a309cf8 test(bundler-plugins): Disable CLI telemetry in the CLI contract tests (#25308)

71f1ef9 test(e2e): Inherit root Volta config in all e2e test apps (#25369)

e54e577 chore: Add external contributor to CHANGELOG.md (#25375)

0ed4606 fix(sveltekit): add op and origin to Kit's sveltekit.endpoint span (#25376)

9516aeb fix(cloudflare): auto-instrument when wrangler main is a package (#25343)

7471347 feat(core): Support SuppressedError in LinkedErrors integration (#25246)

f4ae6c5 fix(browser): Apply urlQueryParams to the Referer header (#25324)

Additional commits viewable in compare view

[

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• `@dependabot show

Labeled:

October 19, 2026 at 03:20AM

via GitHub https://ift.tt/56dOxVy

[Oneseco-Media/rsshub]

Bump rolldown from 1.2.8 to 1.2.14

By dependabot[bot]

Assigned to

Bumps rolldown from 1.2.8 to 1.2.14.

Release notes

Sourced from rolldown's releases.

v1.2.14

[1.2.14] - 2026-10-14

🚀 Features

add output.charset option (#11194) by @​sapphi-red

code-splitting: route independent ESM re-exports per consumer (#11177) by @​hyfdev

🐛 Bug Fixes

handle output.charset: 'ascii' + output.minify: false (#11207) by @​sapphi-red

tree-shaking: preserve initialization of wrapped ESM re-exports (#11167) by @​hyfdev

sourcemap: preserve boundaries when tracing has no mapping (#11170) by @​sapphi-red

strict-execution-order: account for init imports during code splitting (#11162) by @​hyfdev

strict-execution-order: avoid eager loading through mixed re-exports (#11151) by @​hyfdev

tree-shake expression statements that coerce known constants (#10825) by @​IWANABETHATGUY

shim-missing-exports: shim deep namespace reads through default imports (#11184) by @​IWANABETHATGUY

shim-missing-exports: shim missing static namespace members (#11179) by @​hyfdev

preserve-entry-signatures: keep internal bindings out of entry exports (#11094) by @​hyfdev

report ASSIGN_TO_IMPORT for writes to re-exported namespace members (#11148) by @​IWANABETHATGUY

dev: keep files loaded by the HMR stage watched when the same task rebuilds (#11154) by @​Brooooooklyn

dev: watch lazily compiled files even when a build starts first (#11152) by @​Brooooooklyn

cjs: print a CommonJS module's top-level this as a wrapper parameter rolldown names (#11135) by @​IWANABETHATGUY

renamer: keep fixed names off the bindings that would capture them (#11134) by @​IWANABETHATGUY

renamer: keep an external require() local in a CJS module off the top-level names (#11133) by @​IWANABETHATGUY

rolldown: make a repeated close() a no-op (#11142) by @​Brooooooklyn

avoid renaming entry top-level bindings onto their nested bindings (#11122) by @​IWANABETHATGUY

renamer: keep generated top-level names off inner bindings (#11121) by @​IWANABETHATGUY

🚜 Refactor

renamer: treat a CJS-wrapped module's root scope as an inner scope (#11130) by @​IWANABETHATGUY

📚 Documentation

add renaming design and implementation docs (#11131) by @​IWANABETHATGUY

⚡ Performance

ci: overlap independent setup, checks, and artifacts (#11169) by @​hyfdev

🧪 Testing

dev: use dunce::canonicalize so dev engine tests pass on Windows (#11192) by @​shulaoda

preserve-entry-signatures: cover nested dynamic imports (#11164) by @​hyfdev

⚙️ Miscellaneous Tasks

deps: upgrade oxc to 0.154.0 (#11209) by @​shulaoda

make Security Analysis pass again (security-action v1.0.10, serde_yaml -> saphyr) (#11197) by @​Brooooooklyn

... (truncated)

Changelog

Sourced from rolldown's changelog.

[1.2.14] - 2026-10-14

🚀 Features

add output.charset option (#11194) by @​sapphi-red

code-splitting: route independent ESM re-exports per consumer (#11177) by @​hyfdev

🐛 Bug Fixes

handle output.charset: 'ascii' + output.minify: false (#11207) by @​sapphi-red

tree-shaking: preserve initialization of wrapped ESM re-exports (#11167) by @​hyfdev

sourcemap: preserve boundaries when tracing has no mapping (#11170) by @​sapphi-red

strict-execution-order: account for init imports during code splitting (#11162) by @​hyfdev

strict-execution-order: avoid eager loading through mixed re-exports (#11151) by @​hyfdev

tree-shake expression statements that coerce known constants (#10825) by @​IWANABETHATGUY

shim-missing-exports: shim deep namespace reads through default imports (#11184) by @​IWANABETHATGUY

shim-missing-exports: shim missing static namespace members (#11179) by @​hyfdev

preserve-entry-signatures: keep internal bindings out of entry exports (#11094) by @​hyfdev

report ASSIGN_TO_IMPORT for writes to re-exported namespace members (#11148) by @​IWANABETHATGUY

dev: keep files loaded by the HMR stage watched when the same task rebuilds (#11154) by @​Brooooooklyn

dev: watch lazily compiled files even when a build starts first (#11152) by @​Brooooooklyn

cjs: print a CommonJS module's top-level this as a wrapper parameter rolldown names (#11135) by @​IWANABETHATGUY

renamer: keep fixed names off the bindings that would capture them (#11134) by @​IWANABETHATGUY

renamer: keep an external require() local in a CJS module off the top-level names (#11133) by @​IWANABETHATGUY

rolldown: make a repeated close() a no-op (#11142) by @​Brooooooklyn

avoid renaming entry top-level bindings onto their nested bindings (#11122) by @​IWANABETHATGUY

renamer: keep generated top-level names off inner bindings (#11121) by @​IWANABETHATGUY

🚜 Refactor

renamer: treat a CJS-wrapped module's root scope as an inner scope (#11130) by @​IWANABETHATGUY

📚 Documentation

add renaming design and implementation docs (#11131) by @​IWANABETHATGUY

⚡ Performance

ci: overlap independent setup, checks, and artifacts (#11169) by @​hyfdev

🧪 Testing

dev: use dunce::canonicalize so dev engine tests pass on Windows (#11192) by @​shulaoda

preserve-entry-signatures: cover nested dynamic imports (#11164) by @​hyfdev

⚙️ Miscellaneous Tasks

deps: upgrade oxc to 0.154.0 (#11209) by @​shulaoda

make Security Analysis pass again (security-action v1.0.10, serde_yaml -> saphyr) (#11197) by @​Brooooooklyn

deps: update rollup submodule for tests to v4.64.5 (#11190) by @​rolldown-guard[bot]

... (truncated)

Commits

c9a8cda release: v1.2.14 (#11210)

970ad1f fix: handle output.charset: 'ascii' + output.minify: false (#11207)

dd2f65f feat: add output.charset option (#11194)

e148823 feat(code-splitting): route independent ESM re-exports per consumer (#11177)

0c1de40 fix(strict-execution-order): account for init imports during code splitting (...

f71e200 fix(shim-missing-exports): shim missing static namespace members (#11179)

5900698 fix(preserve-entry-signatures): keep internal bindings out of entry exports (...

59f88f8 fix(rolldown): make a repeated close() a no-op (#11142)

f7de35f release: v1.2.13 (#11144)

4229721 chore(deps): upgrade oxc to 0.153.0 (#11109)

Additional commits viewable in compare view

[

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• `@dependabot show

Labeled:

October 19, 2026 at 03:20AM

via GitHub https://ift.tt/uZ3StfO

[Oneseco-Media/rsshub]

Bump header-generator from 2.1.88 to 2.1.89

By dependabot[bot]

Assigned to

Bumps header-generator from 2.1.88 to 2.1.89.

Release notes

Sourced from header-generator's releases.

v2.1.89

What's Changed

chore: accept null values in screen.hasHDR, fix model generator by @​barjin in apify/fingerprint-suite#570

fix: normalize viewport fingerprint dimensions by @​AmitHaina in apify/fingerprint-suite#572

perf: lazy-load ow and browserslist in header-generator by @​barjin in apify/fingerprint-suite#577

New Contributors

@​AmitHaina made their first contribution in apify/fingerprint-suite#572

Full Changelog: https://github.com/apify/fingerprint-suite/compare/v2.1.88...v2.1.89

Commits

715a776 perf: lazy-load ow and browserslist in header-generator (#577)

67866a6 ci: bump pr-title-check action to v1.6.1 (#576)

44769da chore(deps): bump browserslist, qs and @​humanfs/node (#575)

2e0a2a2 ci: pin third-party actions to commit SHAs (#574)

4820d1e chore(deps): bump js-yaml to 4.3.1 (#573)

f26dddb fix: normalize viewport fingerprint dimensions (#572)

d6a508a chore: accept null values in screen.hasHDR, fix model generator (#570)

See full diff in compare view

[

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• `@dependabot show

Labeled:

October 19, 2026 at 03:19AM

via GitHub https://ift.tt/oiYlWwr

[Oneseco-Media/rsshub]

Bump jsdom from 30.0.1 to 30.1.3

By dependabot[bot]

Assigned to

Bumps jsdom from 30.0.1 to 30.1.3.

Release notes

Sourced from jsdom's releases.

v30.1.3

Improved performance of getComputedStyle() and computed CSS property reads, including with stylesheets containing attribute selectors. (@​scttcper, @​asamuzaK)

Fixed slowdowns when focusing elements and running interaction tests, which regressed in v30.1.2. (@​scttcper)

Fixed XMLHttpRequest reusing credentials supplied to xhr.open() after cross-origin redirects, including in response to authentication challenges from the destination.

Fixed XMLHttpRequest incorrectly sending and accepting cookies after cross-origin redirects back to the document's origin when xhr.withCredentials is false.

Fixed exceptions from malformed CSS math functions, such as calc(0px - @submenu_space), while parsing documents, stylesheets, and style declarations. (@​rnavarro)

Fixed getComputedStyle() ignoring style rules nested inside multiple @media rules.

Fixed CSS shorthands overwriting longhands with higher priority or specificity during style computation, including declarations containing CSS variables.

Fixed getComputedStyle() returning unresolved or inconsistent shorthand values, including for 'background', 'border', 'flex', 'font', 'margin', and 'padding', and incorrect shorthand defaults and inheritance.

Fixed computed background positions to resolve font-relative lengths using the final font size and handle multiple image layers correctly.

Fixed computed 'color' values depending on property read order, including unresolved color-mix() results, which regressed in v29.0.2.

Fixed currentcolor border colors incorrectly becoming transparent when 'color' uses light-dark() or relative color syntax.

Fixed CSS calculations that reduce to a percentage incorrectly producing pixel values, which regressed in v30.0.0.

Fixed numeric font weights in the 'font' shorthand incorrectly setting 'line-height'.

Fixed selector matching involving XML namespaces, and selectors such as [data-a|=""] failing to match empty values and values beginning with -. (@​asamuzaK)

v30.1.2

Updated URLs to support Unicode v18.0.0 in internationalized domain names.

Reduced package size and memory use for CSS property definitions. (@​scttcper)

Fixed severe slowdowns when building large DOM trees, including SVG charts with D3, which regressed in v30.1.0. (@​cmdcolin)

Fixed exponentially slow reads of empty inherited CSS custom properties in deeply nested documents, and custom properties incorrectly inheriting past an initial reset. (@​scttcper)

Fixed getComputedStyle() returning stale results after editing stylesheet declarations, selectors, or media queries, including in imported stylesheets.

Fixed selector matching and computed styles after changes to form control checkedness, indeterminacy, selection, values, and validity, including during form resets and canceled clicks.

Fixed computed styles for :focus, :focus-visible, :focus-within, and selectors containing them after focus changes, including inside focus and blur listeners. (@​asamuzaK)

Fixed element.focus() incorrectly focusing elements hidden by 'display', including through shadow hosts and slots, and elements excluded by shadow DOM slot assignment. (@​asamuzaK)

Fixed getComputedStyle() throwing for elements without inline-style support, including XML and MathML elements.

Fixed a memory leak where stylesheet parsing retained the last parsed stylesheet's window after window.close().

Fixed memory growth from long-lived MutationObserver instances retaining bookkeeping for garbage-collected nodes. (@​scttcper)

Fixed retained select.selectedOptions collections becoming stale after selection changes and form resets.

Fixed rejection of negative CSS sizing values, including for 'min-width', 'min-height', 'max-width', and 'max-height', which regressed in v30.1.0.

Fixed handling of deeply nested color-mix() expressions, including exceptions during color resolution. (@​asamuzaK)

v30.1.1

Fixed spurious window blur and focusout events and incorrect event.relatedTarget values when focusing an element after removing the previously focused element, which regressed in v30.1.0. (@​asamuzaK)

Fixed focus and blur behavior across frames, and focusing the document's viewport through document.documentElement.focus(). (@​asamuzaK)

Fixed focus targets removed or disabled by blur listeners becoming active, and text selections made by focus and blur listeners being overwritten. (@​asamuzaK)

Fixed element.focus() incorrectly focusing disabled form controls and <input type="hidden"> elements with tabindex="". (@​scttcper)

Fixed invalid style.setProperty() calls changing existing !important priorities, serialized styles, or mutation records. (@​FedgeNo)

Fixed !important handling when updating CSS longhands after shorthands, using variables or CSS-wide keywords, and assigning style properties directly. (@​FedgeNo)

Fixed <noscript> parsing with includeNodeLocations: true or inside frames to honor the runScripts option.

Fixed the storageQuota option being ignored by frames.

Fixed encoding detection of HTML and XML byte input to honor XML encoding declarations and detect UTF-16 without a byte order mark.

Fixed exceptions caused by truncated charset parameters in <meta> elements, and encoding detection incorrectly using incomplete <meta> tags. (@​FedgeNo)

Fixed XML serialization errors for namespaces named constructor, toString, proto, or "null", and incorrect reuse of namespace prefixes declared on sibling elements.

Fixed element.innerHTML and element.outerHTML in XML documents to reject invalid characters in attribute values and avoid stack overflows on large strings.

Fixed selector matching for :lang(), :nth-child(... of ...) after mutations, and :has() with duplicate IDs or nested logical pseudo-classes. (@​asamuzaK)

v30.1.0

jsdom is feeling the AGI!

... (truncated)

Commits

058c0f5 30.1.3

fcd1fd1 Cascade parsed longhands independently

a3ee786 Cascade computed style properties on demand

f42dc15 Resolve colors before caching or using currentcolor

074b1fb Compute background-position lengths against the final font size

d19598c Apply style rules nested in multiple @​media rules

45d626c Rule out attribute selector subjects before matching

3ff0a5b Upgrade Undici and remove abort workarounds

8813bb1 Ignore CSS declarations with unparseable math functions

63712d8 Fix XHR credentials across redirects

Additional commits viewable in compare view

[

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• `@dependabot show

Labeled:

October 19, 2026 at 03:19AM

via GitHub https://ift.tt/jzXGLSO

[Oneseco-Media/rsshub]

Bump markdown-it from 15.0.2 to 15.0.3

By dependabot[bot]

Assigned to

Bumps markdown-it from 15.0.2 to 15.0.3.

Changelog

Sourced from markdown-it's changelog.

[15.0.3] - 2026-10-16

Changed

Updated dependencies.

Fixed

Enforce the 999 Unicode code point limit for reference definition labels, partially addressing #1213.

Require whitespace before multiline reference titles.

Security

Fixed quadratic complexity when parsing multiline reference definitions.

Fixed quadratic complexity when parsing unclosed inline HTML comments, processing instructions, declarations and CDATA sections.

Commits

a8c00d4 15.0.3 released

e9504a4 Skip pathological speed tests during coverage collection

46d8b52 Deps bump

928bc8c Fix quadratic inline HTML parsing

48fbc46 Fix quadratic reference parsing and partially address #1213

See full diff in compare view

[

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• `@dependabot show

Labeled:

October 19, 2026 at 03:17AM

via GitHub https://ift.tt/VFx80Zi

[Oneseco-Media/rsshub]

Bump @googleapis/youtube from 38.0.0 to 40.0.1

By dependabot[bot]

Assigned to

Bumps @googleapis/youtube from 38.0.0 to 40.0.1.

Release notes

Sourced from @​googleapis/youtube's releases.

youtube: v40.0.1

40.0.1 (2026-10-14)

Bug Fixes

youtube: update the API (62f24f4)

youtube: v40.0.0

40.0.0 (2026-10-03)

⚠ BREAKING CHANGES

youtube: This release has breaking changes.

Features

youtube: update the API (06d08ca)

run: v38.3.0

38.3.0 (2026-10-14)

Features

run: update the API (673f9ae)

networkservices: v38.2.1

38.2.1 (2026-10-14)

Bug Fixes

networkservices: update the API (c8b93fe)

networkservices: v38.2.0

38.2.0 (2026-10-03)

Features

networkservices: update the API (476f865)

run: v38.2.0

38.2.0 (2026-10-03)

Features

... (truncated)

Changelog

Sourced from @​googleapis/youtube's changelog.

40.0.1 (2019-07-02)

Bug Fixes

make webpack work on Windows (#1742) (cac269f)

deps: update googleapis-common to most recent release. (#1739) (8bfa702)

docs: make anchors work in jsdoc (#1747) (799e391)

docs: move to new client docs URL (#1734) (4df71ed)

40.0.0 (2019-05-13)

Bug Fixes

Incorrect case README (#1706) (3e17bd8)

samples: fix readline args in youtube upload (#1676) (3db63d6)

Build System

upgrade engines field to >=8.10.0 (#1691) (8428d5c)

Features

run the generator (#1680) (6d5a9c8)

run the generator (#1709) (6817c39)

BREAKING CHANGES

This release has a few breaking changes.

Node.js 8.x is now the minimum required version

The healthcare/v1alpha API has been removed

Uses google-auth-library 4.0

upgrade engines field to >=8.10.0 (#1691)

v39.2.0

04-03-2019 16:17 PDT

This release has a few hot new APIs:

healthcare_v1beta1

run_v1

run_v1alpha1

securitycenter_v1

securitycenter_v1beta1

New Features

... (truncated)

Commits

cb9326b chore: release 40.0.1 (#1735)

d0f64cd docs: fixes options section anchor link (#1745)

954d5b6 build: use config file for linkinator (#1748)

4fe7fde build: switch to magic proxy for release-please. (#1743)

8bfa702 fix(deps): update googleapis-common to most recent release. (#1739)

cac269f fix: make webpack work on Windows (#1742)

799e391 fix(docs): make anchors work in jsdoc (#1747)

00d673b build: use c8 for coverage (#1737)

3d20cd4 chore(deps): update dependency typescript to ~3.5.0 (#1724)

58e2a0b chore(deps): update dependency p-queue to v6 (#1730)

Additional commits viewable in compare view

[

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• `@dependabot show

Labeled:

October 19, 2026 at 03:17AM

via GitHub https://ift.tt/rOWMdmA

[Oneseco-Media/rsshub]

Bump dotenv from 17.4.2 to 18.0.8

By dependabot[bot]

Assigned to

Bumps dotenv from 17.4.2 to 18.0.8.

Changelog

Sourced from dotenv's changelog.

18.0.8 (2026-10-14)

Changed

Fast parser should strip appended extra quotes (#1073)

Type detail improvement (#1074)

18.0.7 (2026-10-09)

Changed

Treat undefined settings like quiet: true as null rather than falsey (#1070)

CLI should honor DOTENV_QUIET setting in .env file (#1071)

18.0.6 (2026-10-06)

Changed

Use smarter parseBoolean not Boolean() to fix override (#1069)

18.0.5 (2026-09-30)

Changed

Fix missing typescript module declaration (#1068)

Improve performance for large .env files (#1066)

18.0.4 (2026-09-25)

Changed

import dotenv/config should default quiet: true (#1063)

18.0.3 (2026-09-22)

Changed

Patch DOTENV_QUIET setting when inside .env file (#1059)

18.0.2 (2026-09-21)

Changed

Patch additional edge cases for the fast parser (#1056)

18.0.1 (2026-09-18)

Changed

Handle file urls in config logging (#1054)

... (truncated)

Commits

e2fe95e 18.0.8

7aa712a type detail improvement

53405b0 Merge pull request #1074 from himanshu748/codex/fix-dotenv-populate-undefined...

0b4843a changelog

55855ab Merge pull request #1073 from xiehuanyi/fix/unicode-unquoting-parity

f757811 fix(types): allow undefined values in populate output

fde5db2 Keep fast-parser unquoting consistent at Unicode line boundaries

2953207 18.0.7

9944723 make more readable for undefined -> null

d455db0 Merge branch 'master' of github.com:motdotla/dotenv

Additional commits viewable in compare view

[

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• `@dependabot show

Labeled:

October 19, 2026 at 03:15AM

via GitHub https://ift.tt/4XE3t26

[Oneseco-Media/rsshub]

Bump imapflow from 2.0.2 to 2.5.0

By dependabot[bot]

Assigned to

Bumps imapflow from 2.0.2 to 2.5.0.

Changelog

Sourced from imapflow's changelog.

2.5.0 (2026-10-16)

Features

add a transport option and createSocketsTransport() for celld (f4411aa)

add createStreamsTransport() for socket APIs built on web streams (fec7999)

2.4.3 (2026-10-15)

Bug Fixes

fail the command on a NO or BAD status line without a tag (5a38e17)

send ID after STARTTLS instead of before it (7d6f37a)

send ID after STARTTLS instead of before it (197ecdc)

2.4.2 (2026-10-14)

Bug Fixes

deps: update libmime to 5.4.8 and mailsplit to 5.4.21 (8eafb46)

2.4.1 (2026-10-14)

Bug Fixes

download: bump libbase64 to decode padded base64 parts in linear memory (1c83261)

2.4.0 (2026-10-10)

Features

re-raise unexpected parser exceptions as coded ParserErrorInternal errors (dda3f7e)

Bug Fixes

keep append literals in sync with their data and fail downloads cleanly (752248e)

2.3.0 (2026-10-08)

Features

emit an alert event for ALERT response codes (dcc0e42)

... (truncated)

Commits

bb0152e Merge pull request #436 from postalsys/release-please--branches--master--comp...

a4043c0 chore: drop the duplicate 2.5.0 changelog entry [skip ci]

f50b210 chore(master): release 2.5.0 [skip-ci]

c092ac4 Merge pull request #437 from postalsys/browser-transport

fec7999 feat: add createStreamsTransport() for socket APIs built on web streams

f4411aa feat: add a transport option and createSocketsTransport() for celld

fab4e8a Merge pull request #435 from postalsys/release-please--branches--master--comp...

9014b57 chore(master): release 2.4.3 [skip-ci]

5a38e17 fix: fail the command on a NO or BAD status line without a tag

7d6f37a Merge pull request #434 from pacificsky/pacificsky/imapflow_startls

Additional commits viewable in compare view

[

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• `@dependabot show

Labeled:

October 19, 2026 at 03:15AM

via GitHub https://ift.tt/GdZkobF

[Oneseco-Media/rsshub]

Bump patchright from 1.63.0 to 1.64.1

By dependabot[bot]

Assigned to

Bumps patchright from 1.63.0 to 1.64.1.

Release notes

Sourced from patchright's releases.

v1.64.1

This is an automatic deployment in response to a new release of microsoft/playwright. The original release can be seen here.

v1.64.0

This is an automatic deployment in response to a new release of microsoft/playwright. The original release can be seen here.

Commits

2d2b887 [Patch-Comparison] Automatic Commit: fix: investigate Playwright v1.64.0 rele...

79fc6fc fix: investigate Playwright v1.64.0 release failure (#250)

ba8bd9b Update NodeMaven Sponsor

79a3395 Add ProxyLane Sponsor

406b3b0 [Patch-Comparison] Automatic Commit: Fix request listener leak and crash retr...

86be858 Fix request listener leak and crash retry loop (#247)

26ab9ae Remove ColaProxy Sponsor

2b4ba5f Update Nodemaven Sponsor

See full diff in compare view

[

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• `@dependabot show

Labeled:

October 19, 2026 at 03:14AM

via GitHub https://ift.tt/gB5PW9a

[Oneseco-Media/rsshub]

Bump the nix group across 1 directory with 3 updates

By dependabot[bot]

Assigned to

Bumps the nix group with 3 updates in the / directory: devenv, flake-utils and nixpkgs.

Updates devenv from 6e32383 to 1566050

Commits

1566050 fix(javascript): make automatic pnpm installs noninteractive (#3276)

03582fa fix(tui): show failed process prerequisites (#3275)

ce6e5e3 fix(watcher): stop waiting for readiness once the fs worker has exited (#3282)

f0e28b3 hook: keep the entered subdirectory when auto-activating (#3280)

30ef5a2 test: consume CLI smoke output before asserting matches (#3279)

1049c53 fix: keep task PATH exports on their own line in shell-env.sh (#3166)

2118663 fix(rust): provide an LSP for minimal toolchain files (#3274)

5a0f258 fix(rust): use custom toolchain standard-library sources (#3271)

72e18a7 fix(hook): bypass fish functions for cat, rm, devenv; add regression test (#3...

a60ff7d fix(elixir): expose the matching Erlang runtime (#3259)

Additional commits viewable in compare view

Updates flake-utils from 11707dc to b7a79d3

Commits

b7a79d3 Merge pull request #127 from numtide/maiao.Ie3470c7419eb69dc99c01734e17f88ce9...

67cec90 ci: install Nix with NixOS/nix-installer-action

See full diff in compare view

Updates nixpkgs from eaad089 to 55bfb4d

Commits

55bfb4d cargo-semver-checks: 0.50.0 -> 0.51.0 (#573891)

f113610 tpm2-abrmd: fix meta.homepage, add meta.changelog (#573870)

21ee3f0 hittekaart: 0.2.0 -> 0.2.1 (#573843)

4c3c943 .github/ISSUE_TEMPLATE: request a minimal flake.nix (#570710)

78130ba .github/ISSUE_TEMPLATE: request a minimal flake.nix

fd2fd56 cargo-semver-checks: 0.50.0 -> 0.51.0

4c9af74 python3Packages.nyt-games: 1.0.0 -> 1.0.1 (#573874)

6f9e75f {net,free}bsd.compat: claim the hosts each one supports (#573846)

e282b26 stash: add riscv64-linux support (#572830)

7e25ec8 {net,free}bsd.compat: claim the hosts each one supports

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• `@dependabot show

Labeled:

October 19, 2026 at 03:14AM

via GitHub https://ift.tt/EXoDFe6

[Oneseco-Media/rsshub]

Bump rate-limiter-flexible from 11.2.0 to 11.2.2

By dependabot[bot]

Assigned to

Bumps rate-limiter-flexible from 11.2.0 to 11.2.2.

Release notes

Sourced from rate-limiter-flexible's releases.

Queue: fix redundant limiter creation

What's Changed

fix(queue): store the default queue under the 'limiter' key by @​OsamaAnsar in animir/node-rate-limiter-flexible#368

New Contributors

@​OsamaAnsar made their first contribution in animir/node-rate-limiter-flexible#368

Full Changelog: https://github.com/animir/node-rate-limiter-flexible/compare/v11.2.1...v11.2.2

:palm_tree:

Extend types for RateLimiterValkey options

What's Changed

extend IRateLimiterValkeyOptions by rejectIfValkeyNotReady by @​streifehoernli in animir/node-rate-limiter-flexible#367

New Contributors

@​streifehoernli made their first contribution in animir/node-rate-limiter-flexible#367

Full Changelog: https://github.com/animir/node-rate-limiter-flexible/compare/v11.2.0...v11.2.1

:cat:

Commits

1a786c8 11.2.2

6b19861 Merge pull request #368 from OsamaAnsar/fix/rate-limiter-queue-default-key

2f7b1b8 fix(queue): store the default queue under the 'limiter' key

1bf9eb1 11.2.1

13f88b4 extend IRateLimiterValkeyOptions by rejectIfValkeyNotReady (#367)

97fd58a update context

See full diff in compare view

[

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• `@dependabot show

Labeled:

October 19, 2026 at 03:14AM

via GitHub https://ift.tt/plQ9gwB

[Cybersoulja/Agentic-Telegram-TMA]

Verify Telegram webhook secret token on /webhook

By Cybersoulja

Assigned to

Summary

• /webhook previously accepted any POST, so anyone who found the Worker URL could trigger billed Gemini calls and D1 writes with fake updates.
• Adds optional WEBHOOK_SECRET. /setup-webhook registers it with Telegram as secret_token; /webhook returns 403 unless the X-Telegram-Bot-Api-Secret-Token header matches.
• If WEBHOOK_SECRET is unset, behavior is unchanged (logs a warning), so this deploys safely before the secret is set.
• Documented in CLAUDE.md and .dev.vars.example.

Rollout (after merge)

1. wrangler secret put WEBHOOK_SECRET (letters, digits, _, - only)
2. Open GET /setup-webhook once to re-register the webhook with the secret.

Test plan

• npm run check-types (both workspaces)
• Local wrangler dev with secret set: no header → 403, wrong header → 403, correct header → 200

_Generated by [Claude Code](https://ift.tt/SrdNjkz

Labeled:

October 17, 2026 at 06:42PM

via GitHub https://ift.tt/nuDCoAU

[Cybersoulja/oneseco-io]

Fix explicit definition of Drizzle relations and implements dynamic choices

By Cybersoulja

Assigned to

Fix explicit definition of Drizzle relations and implements dynamic choices over hardcoded ones in the front end.

PR created automatically by Jules for task 14341198763395431251 started by @Cybersoulja

Labeled:

October 17, 2026 at 03:38PM

via GitHub https://ift.tt/6N2KQwn

[Oneseco-Media/rsshub]

Bump eslint-plugin-unicorn from 74.0.0 to 78.0.0

By dependabot[bot]

Assigned to

Bumps eslint-plugin-unicorn from 74.0.0 to 78.0.0.

Release notes

Sourced from eslint-plugin-unicorn's releases.

v78.0.0

New rules

no-unnecessary-default-arguments (#3885) 1059f09b

no-repeated-call-wrappers (#3836) c4fd1feb

Improvements

Add SOML support, including a recommended-soml preset (#3870) 7419b835

Report code that contains comments instead of ignoring it (#3847) 003f0bdc

Many rules skipped code with comments. They now report it, and only withhold fixes that would remove comments. You may see new reports.

Fix cyclic resolution in type-aware checks (#3826) 5e77e19e

prefer-default-parameters: Add checkFallbackExpressions option (#3837) 71bbf59a

prefer-ternary: Add checkVaryingBase and checkComputedMemberAccess options (#3869) 1af3c2b2

consistent-boolean-name: Allow does prefix by default (#3853) cfad028d

consistent-boolean-name: Recognize promise-returning functions (#3879) 769e3b87

consistent-boolean-name: Fix cyclic type parameter resolution (#3821) 5c4808ba

no-asterisk-prefix-in-documentation-comments: Remove shared indentation (#3820) a92aee19

no-await-in-promise-methods: Clarify the message for nested await (#3867) 8f73d539

no-immediate-mutation: Combine a declaration with an assignment that follows it immediately (#3851) 811e4678

no-negated-condition: Support && and || chains of negated operands (#3834) 15bfade7

no-top-level-side-effects: Allow known pure imported helpers, like defineConfig() and React memo(), and check default-exported expressions (#3822) 3826236d

no-unnecessary-parameters: Fix false positive for recursive defaults (#3844) e2d8d0ff

no-unnecessary-parameters: Ignore parameters named by type predicates (#3859) f0c631ce

no-using-resource-escape: Check TypeScript instantiation expressions (#3833) 7a9f7df1

prefer-at: Fix false positives for DOM collections (#3842) ca78a7aa

prefer-combined-guards: Combine non-literal exits in TypeScript when type information is available (#3860) 2bcc7be6

prefer-default-parameters: Support static template literal fallbacks (#3835) 3d8b40a5

prefer-default-parameters: Support fallbacks to earlier bindings (#3840) d4bfc1cf

prefer-default-parameters: Handle nullable fallback types (#3858) d75786f7

prefer-early-return, prefer-continue: Suggest opposite relational comparisons (#3873) de2e6daa

prefer-logical-operator-over-ternary: Handle non-boolean conditions (#3843) 5c4d50cf

prefer-minimal-ternary: Ignore formatting differences in shared expressions (#3841) b0c21423

prefer-minimal-ternary: Prevent unsafe TypeScript object autofixes (#3846) 2f33c916

prefer-observer-apis: Check let and var listener functions, and ignore reassigned listeners (#3833) 7a9f7df1

prefer-private-class-fields: Do not autofix reassigned methods, and suggest private arrow functions for bound methods (#3823) 6f0f4bb8

prefer-scoped-selector: Ignore queries on more non-element roots, like ownerDocument and getRootNode() (#3833) 7a9f7df1

prefer-spread: Prevent unsafe TypeScript autofixes (#3882) 21e99ff8

prefer-ternary: Support destructuring assignments (#3852) e29d1eee

prefer-ternary: Support statements that differ in only one part, like call(test ? a : b) (#3869) 1af3c2b2

prefer-top-level-await: Allow cached promise assignments (#3819) 2fb8eb60

prefer-top-level-await: Avoid false positives on non-promise calls (#3883) 3f125f14

relative-url-style: Support complex Markdown labels, embedded HTML in Markdown, JSX, URL.canParse(), URL.parse(), and more HTML attributes (#3854) 2760ce46

require-module-specifiers: Allow bare export {} in declaration files (#3866) e7274810

template-indent: Ignore templates with content on the opening line (#3868) 921dd8c3

https://github.com/sindresorhus/eslint-plugin-unicorn/compare/v77.0.0...v78.0.0

... (truncated)

Commits

843495c 78.0.0

1059f09 Add no-unnecessary-default-arguments rule (#3885)

624887f consistent-boolean-name: Explain why do is excluded (#3884)

3f125f1 prefer-top-level-await: Avoid false positives on non-promise calls (#3883)

21e99ff prefer-spread: Prevent unsafe TypeScript autofixes (#3882)

769e3b8 consistent-boolean-name: Recognize promise-returning functions (#3879)

9eadb60 prefer-simple-condition-first: Clarify property access condition classifica...

de2e6da prefer-early-return, prefer-continue: Suggest opposite relational compari...

7419b83 Add SOML support (#3870)

1af3c2b prefer-ternary: Minimize matching branch expressions (#3869)

Additional commits viewable in compare view

[

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• `@dependabot show

Labeled:

October 16, 2026 at 03:11AM

via GitHub https://ift.tt/5W7pRLj

[Oneseco-Media/rsshub]

Bump @sentry/node from 10.74.0 to 11.7.0

By dependabot[bot]

Assigned to

Bumps @sentry/node from 10.74.0 to 11.7.0.

Release notes

Sourced from @​sentry/node's releases.

11.7.0

Important Changes

feat(cloudflare): Add opt-in cron monitoring for Cron Triggers (#25014)

The new cronTriggersIntegration sends check-ins for Cron Triggers. Each check-in includes the schedule from controller.cron, so Sentry creates the monitor on the first run. The integration is opt-in, because monitors are billed.

Cron Triggers have no names, so map each cron expression of your wrangler config to a monitor slug. With the Sentry Cloudflare Vite plugin, add the integration to src/instrument.server.ts:

// src/monitorSlugs.ts export const monitorSlugs: Record<string, string> = { '30 9 * * MON-FRI': 'daily-report', };

// src/instrument.server.ts import * as Sentry from '@​sentry/cloudflare'; import { monitorSlugs } from './monitorSlugs';

export default Sentry.defineCloudflareOptions(env => ({ dsn: env.SENTRY_DSN, integrations: [Sentry.cronTriggersIntegration({ monitorSlug: cron => monitorSlugs[cron] })], }));

// src/index.ts import { monitorSlugs } from './monitorSlugs';

export default { async scheduled(controller, env) { switch (monitorSlugs[controller.cron]) { case 'daily-report': // Your daily report job break; } }, };

The monitorSlug function can also return monitor settings, for example { monitorSlug: 'daily-report', maxRuntime: 30 }, or undefined to send no check-ins for a trigger. Without monitorSlug, the SDK derives the slug from the cron expression. If you deploy with wrangler directly, pass the same integration to Sentry.withSentry.

feat(node): Add neonIntegration for @​neondatabase/serverless (#25164, #25176)

The new neonIntegration creates db spans for queries of the @neondatabase/serverless driver: for the WebSocket Client and Pool, and for the HTTP neon() function. This includes the neon-http and neon-serverless adapters of Drizzle. The integration is on by default when tracing is enabled.

feat(node): Stop sending the process session once request sessions are tracked (#24915)

Node servers sent release health data two times: as request session aggregates, and as the process session of processSessionIntegration. An error in a request also marked the process session as errored, so the SDK counted the error two times. Now the SDK drops the process session when it tracks the first request session. Scripts, CLIs and workers that do not serve requests keep the process session, and so do servers with httpServerIntegration({ sessions: false }). This changes the release health numbers of Node servers, because they no longer send the errored or crashed update of the process session.

feat(server-utils): Record decide calls as gen_ai.decide spans (#25270, #25272, #25274, #25281)

... (truncated)

Changelog

Sourced from @​sentry/node's changelog.

11.7.0

Important Changes

feat(cloudflare): Add opt-in cron monitoring for Cron Triggers (#25014)

The new cronTriggersIntegration sends check-ins for Cron Triggers. Each check-in includes the schedule from controller.cron, so Sentry creates the monitor on the first run. The integration is opt-in, because monitors are billed.

Cron Triggers have no names, so map each cron expression of your wrangler config to a monitor slug. With the Sentry Cloudflare Vite plugin, add the integration to src/instrument.server.ts:

// src/monitorSlugs.ts export const monitorSlugs: Record<string, string> = { '30 9 * * MON-FRI': 'daily-report', };

// src/instrument.server.ts import * as Sentry from '@​sentry/cloudflare'; import { monitorSlugs } from './monitorSlugs';

export default Sentry.defineCloudflareOptions(env => ({ dsn: env.SENTRY_DSN, integrations: [Sentry.cronTriggersIntegration({ monitorSlug: cron => monitorSlugs[cron] })], }));

// src/index.ts import { monitorSlugs } from './monitorSlugs';

export default { async scheduled(controller, env) { switch (monitorSlugs[controller.cron]) { case 'daily-report': // Your daily report job break; } }, };

The monitorSlug function can also return monitor settings, for example { monitorSlug: 'daily-report', maxRuntime: 30 }, or undefined to send no check-ins for a trigger. Without monitorSlug, the SDK derives the slug from the cron expression. If you deploy with wrangler directly, pass the same integration to Sentry.withSentry.

feat(node): Add neonIntegration for @​neondatabase/serverless (#25164, #25176)

The new neonIntegration creates db spans for queries of the @neondatabase/serverless driver: for the WebSocket Client and Pool, and for the HTTP neon() function. This includes the neon-http and neon-serverless adapters of Drizzle. The integration is on by default when tracing is enabled.

feat(node): Stop sending the process session once request sessions are tracked (#24915)

Node servers sent release health data two times: as request session aggregates, and as the process session of processSessionIntegration. An error in a request also marked the process session as errored, so the SDK counted the error two times. Now the SDK drops the process session when it tracks the first request session. Scripts, CLIs and workers that do not serve requests keep the process session, and so do servers with httpServerIntegration({ sessions: false }). This changes the release health numbers of Node servers, because they no longer send the errored or crashed update of the process session.

feat(server-utils): Record decide calls as gen_ai.decide spans (#25270, #25272, #25274, #25281)

... (truncated)

Commits

47dff7d release: 11.7.0

72588e6 Merge pull request #25296 from getsentry/prepare-release/11.7.0

323307a meta(changelog): Update changelog for 11.7.0

87bdc84 fix(bundler-plugins): Escape JSON in generated injection code (#25265)

b80300b fix(server-utils): Stop treating previous_response_id as the OpenAI conversat...

236c0ce fix(browser): Apply urlQueryParams to breadcrumb and element timing URLs (#...

ee04661 fix(browser): Apply urlQueryParams to event URLs, static span names and LCP...

1e86178 fix(nuxt): Keep @sentry/server-runtime-injection external on Nitro v3 (#24901)

8a6b9ca test(node-integration): Stop exporting NODE_VERSION and RUNTIME from the ...

9f7cbad feat(server-utils): Map Mastra classifier evaluations to gen_ai.decide spans ...

Additional commits viewable in compare view

[

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• `@dependabot show

Labeled:

October 16, 2026 at 03:10AM

via GitHub https://ift.tt/a9qfEAH

[Oneseco-Media/rsshub]

Bump zod from 4.6.2 to 4.6.7

By dependabot[bot]

Assigned to

Bumps zod from 4.6.2 to 4.6.7.

Release notes

Sourced from zod's releases.

v4.6.7

Commits:

b500a2ee95134f81d74da7911d7378dd2853d042 4.6.7

v4.6.6

Six malicious commits pushed to main on September 21 with a compromised git credential were reverted the same day in #6620 and have since been removed from the history of main. None were ever published to npm. The npm provenance for 4.6.6 names 284243fb, the pre-rewrite copy of 9c219833 with identical contents.

Commits:

0cd3af5e9f50ad11bbcd4407a46a21b8848ba574 docs: load the en locale directly in Zod Mini

9d5e60f162997b764b40d45aa02481888db50dea docs: import locales from zod/locales, not z.locales

34a626f307871ecbb0123947559328dc52ed5e3e docs: tighten the z.locales tree-shaking note

74304ce5b5796b5edb9a88ceb8e170b6ea3e82df release: stage npm versions instead of publishing them (#6622)

b2ef983e0711ff6517d6020b021071e2e5653efa docs: add Code for Japan to bronze sponsors

8fb2faf0584828a6a027d8279db36f6f52784462 docs: crop the Code for Japan logo and list it first in bronze

bacad518c41610d654658172d325874bf0ee6290 docs: square the Code for Japan logo to match the other bronze tiles

c42596bd1c87e941d7241d10e012c5c196adcc10 release: hold the run on the release-approval environment until the staged versions are approved (#6638)

a2ba4a67986a3e6b2b131be30084a2f460d9ea67 fix(types): declare record output and input as members, not base type arguments (#6645)

a0ebf970f2d752e5f58527cd2942ff48be4f46bd fix(v4): check array, set and map size bounds before parsing elements (#6652)

529f78dd9431b07f49647fee3aa0819b3f8b66b7 4.6.6

9c219833c3a3764fa1f1ea9c5ecec8254a63c0b1 ci: stage at verbose so a failed OIDC token exchange says why

v4.6.5

Commits:

d2b135cfb7a3582b9eb515756b9166bcb9521f4a docs: add the 4.6.x patch highlights to the 4.6 post

f1448f7cee00df9fe1e9ad84a000aa1828cc8bc1 docs: fold the 4.6.x patch highlights into the 4.6 post's own sections

de65a5cb39ed22a507fac935788f718fa88d104f docs: lead the properties section with the check and add a Zod Mini tab (#6598)

56222cd1532c07bcb91b67df529cab4c0a215330 feat(instanceof): key the .properties() shape off the instance type (#6600)

ca0229a404818290e6cdcfefcd7eb2d04bcbb543 Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)"

cc4cd4ee9c52fcaa10964e48cc144541e41a5ed9 Revert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)""

0f3f5ee3ca56c7574bf849e54f79e9a6e02562ee 4.6.5

59bbc03e10c636b9eb3c393dfeb552819774ec21 chore: re-pin the integration peers to the workspace zod after the 4.6.5 bump

v4.6.4

A patch on top of 4.6.3.

d6bc1e30 feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)

ad32d751 perf: z.url() rejects an invalid URL with URL.canParse() instead of a throwing constructor, about 50x faster; fewer allocations on the validation path (#6588)

2bb08717 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump

f6e1701a chore(deps): bump next to 15.5.25 and vite to 7.3.6 (#6153)

v4.6.3

A patch on top of 4.6.2.

413cce9a fix(v4): make z.properties() a check again (#6594) — removes the standalone z.properties() schema from 4.6.0; z.instanceof().properties() and .check(...z.properties()) are unchanged

75d63ee1 docs: show only the .properties() method form in the 4.6 post

46da9572 docs: match the error-message examples to what the parsers emit

Commits

b500a2e 4.6.7

9c21983 ci: stage at verbose so a failed OIDC token exchange says why

529f78d 4.6.6

a0ebf97 fix(v4): check array, set and map size bounds before parsing elements (#6652)

a2ba4a6 fix(types): declare record output and input as members, not base type argumen...

c42596b release: hold the run on the release-approval environment until the staged ve...

bacad51 docs: square the Code for Japan logo to match the other bronze tiles

8fb2faf docs: crop the Code for Japan logo and list it first in bronze

b2ef983 docs: add Code for Japan to bronze sponsors

74304ce release: stage npm versions instead of publishing them (#6622)

Additional commits viewable in compare view

[

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• `@dependabot show

Labeled:

October 16, 2026 at 03:10AM

via GitHub https://ift.tt/cyiCunO

[Oneseco-Media/rsshub]

Bump zod from 4.6.2 to 4.6.6

By dependabot[bot]

Assigned to

Bumps zod from 4.6.2 to 4.6.6.

Release notes

Sourced from zod's releases.

v4.6.6

Six malicious commits pushed to main on September 21 with a compromised git credential were reverted the same day in #6620 and have since been removed from the history of main. None were ever published to npm. The npm provenance for 4.6.6 names 284243fb, the pre-rewrite copy of 9c219833 with identical contents.

Commits:

0cd3af5e9f50ad11bbcd4407a46a21b8848ba574 docs: load the en locale directly in Zod Mini

9d5e60f162997b764b40d45aa02481888db50dea docs: import locales from zod/locales, not z.locales

34a626f307871ecbb0123947559328dc52ed5e3e docs: tighten the z.locales tree-shaking note

74304ce5b5796b5edb9a88ceb8e170b6ea3e82df release: stage npm versions instead of publishing them (#6622)

b2ef983e0711ff6517d6020b021071e2e5653efa docs: add Code for Japan to bronze sponsors

8fb2faf0584828a6a027d8279db36f6f52784462 docs: crop the Code for Japan logo and list it first in bronze

bacad518c41610d654658172d325874bf0ee6290 docs: square the Code for Japan logo to match the other bronze tiles

c42596bd1c87e941d7241d10e012c5c196adcc10 release: hold the run on the release-approval environment until the staged versions are approved (#6638)

a2ba4a67986a3e6b2b131be30084a2f460d9ea67 fix(types): declare record output and input as members, not base type arguments (#6645)

a0ebf970f2d752e5f58527cd2942ff48be4f46bd fix(v4): check array, set and map size bounds before parsing elements (#6652)

529f78dd9431b07f49647fee3aa0819b3f8b66b7 4.6.6

9c219833c3a3764fa1f1ea9c5ecec8254a63c0b1 ci: stage at verbose so a failed OIDC token exchange says why

v4.6.5

Commits:

d2b135cfb7a3582b9eb515756b9166bcb9521f4a docs: add the 4.6.x patch highlights to the 4.6 post

f1448f7cee00df9fe1e9ad84a000aa1828cc8bc1 docs: fold the 4.6.x patch highlights into the 4.6 post's own sections

de65a5cb39ed22a507fac935788f718fa88d104f docs: lead the properties section with the check and add a Zod Mini tab (#6598)

56222cd1532c07bcb91b67df529cab4c0a215330 feat(instanceof): key the .properties() shape off the instance type (#6600)

ca0229a404818290e6cdcfefcd7eb2d04bcbb543 Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)"

cc4cd4ee9c52fcaa10964e48cc144541e41a5ed9 Revert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)""

0f3f5ee3ca56c7574bf849e54f79e9a6e02562ee 4.6.5

59bbc03e10c636b9eb3c393dfeb552819774ec21 chore: re-pin the integration peers to the workspace zod after the 4.6.5 bump

v4.6.4

A patch on top of 4.6.3.

d6bc1e30 feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)

ad32d751 perf: z.url() rejects an invalid URL with URL.canParse() instead of a throwing constructor, about 50x faster; fewer allocations on the validation path (#6588)

2bb08717 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump

f6e1701a chore(deps): bump next to 15.5.25 and vite to 7.3.6 (#6153)

v4.6.3

A patch on top of 4.6.2.

413cce9a fix(v4): make z.properties() a check again (#6594) — removes the standalone z.properties() schema from 4.6.0; z.instanceof().properties() and .check(...z.properties()) are unchanged

75d63ee1 docs: show only the .properties() method form in the 4.6 post

46da9572 docs: match the error-message examples to what the parsers emit

Commits

9c21983 ci: stage at verbose so a failed OIDC token exchange says why

529f78d 4.6.6

a0ebf97 fix(v4): check array, set and map size bounds before parsing elements (#6652)

a2ba4a6 fix(types): declare record output and input as members, not base type argumen...

c42596b release: hold the run on the release-approval environment until the staged ve...

bacad51 docs: square the Code for Japan logo to match the other bronze tiles

8fb2faf docs: crop the Code for Japan logo and list it first in bronze

b2ef983 docs: add Code for Japan to bronze sponsors

74304ce release: stage npm versions instead of publishing them (#6622)

34a626f docs: tighten the z.locales tree-shaking note

Additional commits viewable in compare view

[

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• `@dependabot show

Labeled:

October 14, 2026 at 11:44AM

via GitHub https://ift.tt/0mNhoUe

[Oneseco-Media/rsshub]

Bump p-map from 7.0.7 to 7.1.1

By dependabot[bot]

Assigned to

Bumps p-map from 7.0.7 to 7.1.1.

Release notes

Sourced from p-map's releases.

v7.1.1

Subscribe once to a thenable from an async source next() 1dc1d1f

https://github.com/sindresorhus/p-map/compare/v7.1.0...v7.1.1

v7.1.0

New

Add pMapSettled, pMapKeyed, and pMapSettledKeyed (#70) a05fd50

pMapSettled is like Promise.allSettled(), with a mapper and a concurrency limit

pMapKeyed and pMapSettledKeyed map the values of an object or a Map, like Promise.allKeyed() and Promise.allSettledKeyed()

Add pMapStop to stop iterating from the mapper, like break in a loop (#31) 27606f0

Add preserveOrder option to pMapIterable (#72) 2c0934b

Set it to false to get each result as soon as it is ready, instead of in input order

Make pMapIterable read ahead while the mappers run when backpressure is above concurrency (#78) cada71d

A slow input no longer leaves a mapper waiting for its next element. With the default backpressure, nothing changes

Improvements

Keep the caller in the stack trace of mapper errors (#34) 595754b

Make pMapIterable consume its results in linear time 7d5b6e1

It was O(n²) when backpressure let many results wait, which is the default

Reduce the per-element promise overhead ef82ce6

Give a nullish input the same TypeError as any other invalid input 6f4643d

Fixes

Fix handling of a source that settles its next() calls out of call order 415a474

The index and the result position now follow the order of the next() calls

With stopOnError: false, the errors in the AggregateError are now in input order, not in the order they happened

Fix pMapIterable dropping earlier results when a mapper throws while they are still being read 27606f0

The results before the error are now yielded first, like in a loop

Fix pMapSkip results not counting toward backpressure in pMapIterable 7d5b6e1

A mapper that skips most elements no longer reads further ahead than backpressure allows

Fix pMapIterable pulling and mapping input after return() or throw() while a next() call is pending 5f2c01d

https://github.com/sindresorhus/p-map/compare/v7.0.8...v7.1.0

v7.0.8

Fix pMapIterable calling next() on an exhausted source iterator 70479bf

Fix pMap hanging on a source that blocks in next() after it is exhausted 7c5cee7

Fix pMap preferring the sync iterator when the input has both 669fdc6

Fix pMapIterable calling the mapper for input that arrives after iteration stopped fca6099

Fix: Don't call return() on an exhausted source iterator in pMapIterable a97778a

Fix pMap not closing the source iterator when it rejects c82bd07

Fix pMapIterable not closing the source iterator when iteration stops early e7c2ecb

... (truncated)

Commits

d61b6a3 7.1.1

1dc1d1f Subscribe once to a thenable from an async source next()

1051ec7 More tests

683a68e 7.1.0

595754b Keep the caller in the stack trace of mapper errors

d9cd930 Document how to choose a concurrency value

a05fd50 Add pMapSettled, pMapKeyed, and pMapSettledKeyed

36078d3 Add dynamic concurrency recipe

cada71d Make pMapIterable read ahead while the mappers run when backpressure is a...

27606f0 Add pMapStop to stop iterating from the mapper

Additional commits viewable in compare view

[

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• `@dependabot show

Labeled:

October 14, 2026 at 11:44AM

via GitHub https://ift.tt/0Ejy82S

[Oneseco-Media/rsshub]

Bump tsdown from 0.23.0 to 0.23.1

By dependabot[bot]

Assigned to

Bumps tsdown from 0.23.0 to 0.23.1.

Release notes

Sourced from tsdown's releases.

v0.23.1

   🐞 Bug Fixes

Preserve false tsconfig option  -  by @​Masutayunikon in rolldown/tsdown#1065 (407f8)

entry: Honor custom root for object entry  -  by @​giaBaoJS in rolldown/tsdown#1072 (17452)

pkg: Pack tarball inside npm publish --dry-run  -  by @​giaBaoJS in rolldown/tsdown#1076 (83f0c)

    View changes on GitHub

Commits

6493257 chore: release v0.23.1

ba6acb9 chore: upgrade deps

6cbfec7 chore(deps): update dependency unplugin-vue to v8 (#1090)

eb40c95 chore: declare package side effects

f9c95d0 chore: align pnpm workspace settings

e64bde4 chore: configure pnpm via devEngines

83f0c57 fix(pkg): pack tarball inside npm publish --dry-run (#1076)

1745223 fix(entry): honor custom root for object entry (#1072)

9655dcb chore: upgrade deps

30da631 docs: correct default value of minify

Additional commits viewable in compare view

[

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• `@dependabot show

Labeled:

October 14, 2026 at 11:44AM

via GitHub https://ift.tt/eUld7PC

[Oneseco-Media/rsshub]

Bump uuid from 14.0.2 to 14.0.3

By dependabot[bot]

Assigned to

Bumps uuid from 14.0.2 to 14.0.3.

Release notes

Sourced from uuid's releases.

v14.0.3

14.0.3 (2026-10-09)

Bug Fixes

fix CITGM #1154 (#981) (b44f159)

Changelog

Sourced from uuid's changelog.

14.0.3 (2026-10-09)

Bug Fixes

fix CITGM #1154 (#981) (b44f159)

Commits

993ff7b chore(main): release 14.0.3 (#982)

f7d19b9 chore: update workflow actions (#983)

b44f159 fix: fix CITGM #1154 (#981)

dd8c173 chore: update deps (#975)

See full diff in compare view

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

[

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• `@dependabot show

Labeled:

October 14, 2026 at 11:43AM

via GitHub https://ift.tt/UtIKLYl

[Oneseco-Media/rsshub]

Bump imapflow from 2.0.2 to 2.4.0

By dependabot[bot]

Assigned to

Bumps imapflow from 2.0.2 to 2.4.0.

Changelog

Sourced from imapflow's changelog.

2.4.0 (2026-10-10)

Features

re-raise unexpected parser exceptions as coded ParserErrorInternal errors (dda3f7e)

Bug Fixes

keep append literals in sync with their data and fail downloads cleanly (752248e)

2.3.0 (2026-10-08)

Features

emit an alert event for ALERT response codes (dcc0e42)

Bug Fixes

a throttled login is not a rejected credential (83fdbce)

ask the first chunk of a download again when the answer comes back empty (83fdbce)

2.2.11 (2026-10-08)

Bug Fixes

ask a download chunk again when the answer comes back empty instead of failing the download (0e6e46a)

read NAMESPACE prefixes, QUOTAROOT names and ID values that the server sends as literals (9c77594)

2.2.10 (2026-10-07)

Bug Fixes

log socket errors after a failed STARTTLS upgrade instead of throwing them on Bun (74fad57)

take the requested message in fetchOne() when a FETCH answer also carries unsolicited rows (74fad57), closes #426

2.2.9 (2026-10-07)

Bug Fixes

declare DownloadOptions.binary, the QRESYNC mailboxOpen options and FetchQueryObject.emailId (2ae26e6)

2.2.8 (2026-10-07)

... (truncated)

Commits

1ba1945 Merge pull request #430 from postalsys/release-please--branches--master--comp...

163ad11 chore(master): release 2.4.0 [skip-ci]

752248e fix: keep append literals in sync with their data and fail downloads cleanly

301193e chore: update dev dependencies (imapkit 5.0.1, wrangler 4.149.0) [skip ci]

dda3f7e feat: re-raise unexpected parser exceptions as coded ParserErrorInternal errors

e0fd86e Merge pull request #429 from postalsys/release-please--branches--master--comp...

31a8cdd chore(master): release 2.3.0 [skip-ci]

83fdbce fix: a throttled login is not a rejected credential

9e87abf test: server side changes, quirk presets and fast chaos sessions on imapkit 5...

dcc0e42 feat: emit an alert event for ALERT response codes

Additional commits viewable in compare view

[

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• `@dependabot show

Labeled:

October 14, 2026 at 11:42AM

via GitHub https://ift.tt/W5VIlZ6

[Cybersoulja/trill-local-runtime]

[WIP] Fix failing GitHub Actions job based on logs analysis

By Copilot

Assigned to

Thanks for asking me to work on this. I will get started on it and keep this PR's description up to date as I form a plan and make progress.

Fix the failing GitHub Actions job. Analyze the Actions logs, identify the root cause of the failure, and implement a fix. Job URL: https://ift.tt/5vfKcwM

Labeled:

October 13, 2026 at 05:22AM

via GitHub https://ift.tt/EKiUOh1

[Cybersoulja/trill-local-runtime]

Improve Gemini Send button contrast on macOS

By Copilot

Assigned to

The Send label had poor contrast against macOS’s native light button face, making the control difficult to read.

• Visibility: Use dark text for normal and active states on Aqua; retain white text on other Tk window systems.

send_foreground = BG_DARK if self.tk.call("tk", "windowingsystem") == "aqua" else "#ffffff"

Labeled:

October 13, 2026 at 04:49AM

via GitHub https://ift.tt/vxnuhdI

[Cybersoulja/trill-local-runtime]

[WIP] Fix failing GitHub Actions job Deploy to Cloudflare

By Copilot

Assigned to

Thanks for asking me to work on this. I will get started on it and keep this PR's description up to date as I form a plan and make progress.

Fix the failing GitHub Actions job "Deploy to Cloudflare" Analyze the Actions logs, identify the root cause of the failure, and implement a fix. Check run ID: 115220873921 Job URL: https://ift.tt/Z7Lkna8

Labeled:

October 13, 2026 at 04:17AM

via GitHub https://ift.tt/v5cHURA

[Oneseco-Media/rsshub]

Bump imapflow from 2.0.2 to 2.3.0

By dependabot[bot]

Assigned to

Bumps imapflow from 2.0.2 to 2.3.0.

Changelog

Sourced from imapflow's changelog.

2.3.0 (2026-10-08)

Features

emit an alert event for ALERT response codes (dcc0e42)

Bug Fixes

a throttled login is not a rejected credential (83fdbce)

ask the first chunk of a download again when the answer comes back empty (83fdbce)

2.2.11 (2026-10-08)

Bug Fixes

ask a download chunk again when the answer comes back empty instead of failing the download (0e6e46a)

read NAMESPACE prefixes, QUOTAROOT names and ID values that the server sends as literals (9c77594)

2.2.10 (2026-10-07)

Bug Fixes

log socket errors after a failed STARTTLS upgrade instead of throwing them on Bun (74fad57)

take the requested message in fetchOne() when a FETCH answer also carries unsolicited rows (74fad57), closes #426

2.2.9 (2026-10-07)

Bug Fixes

declare DownloadOptions.binary, the QRESYNC mailboxOpen options and FetchQueryObject.emailId (2ae26e6)

2.2.8 (2026-10-07)

Bug Fixes

decrement mailbox.exists on untagged VANISHED (RFC 7162 section 3.2.10) (b40cea2)

do not send sequence sets to an empty mailbox (b40cea2)

drop flags and keywords that are not atoms instead of sending them quoted (b40cea2)

encode and decode non-ASCII Gmail labels as modified UTF-7 like mailbox names (b40cea2)

expand the FETCH ALL, FAST and FULL macros instead of sending them in a list (b40cea2)

leave servername out of tls.connect() for IP literal hosts, which Bun rejects (b40cea2)

refetch body sections Apache James drops, check FETCH answers belong to the download, enable CONDSTORE with QRESYNC (6973263)

send the OAuth token after the continuation request when SASL-IR is not advertised (b40cea2)

send the STORE UNCHANGEDSINCE modifier before the flags (RFC 7162 section 3.1.3) (b40cea2)

... (truncated)

Commits

e0fd86e Merge pull request #429 from postalsys/release-please--branches--master--comp...

31a8cdd chore(master): release 2.3.0 [skip-ci]

83fdbce fix: a throttled login is not a rejected credential

9e87abf test: server side changes, quirk presets and fast chaos sessions on imapkit 5...

dcc0e42 feat: emit an alert event for ALERT response codes

38e5511 test: search semantics matrix and split-output chaos sessions against ImapKit...

417594e chore(deps): override sharp to 0.35.5 for CVE-2026-96889 [skip ci]

02fc0d3 Merge pull request #428 from postalsys/release-please--branches--master--comp...

714efe1 test: run the TLS reset fault cases on imapkit 4.3.1 [skip ci]

09ddf81 chore(master): release 2.2.11 [skip-ci]

Additional commits viewable in compare view

[

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• `@dependabot show

Labeled:

October 12, 2026 at 07:18PM

via GitHub https://ift.tt/DOpXGoS