Sourced from happy-dom's releases.
\n\n\nv21.0.4
\n:construction_worker_man: Patch fixes
\n\n
\n- Fixed a code injection vulnerability in the ESM compiler - By
\n@capricorn86- Fixed cross-origin isolation so opaque-origin
\ndata:iframes cannot access their parent or top window - By@capricorn86v21.0.3
\n:construction_worker_man: Patch fixes
\n\n
\n- Fixes security vulnerability where authorization header was forwarded when redirecting - By
\n@capricorn86v21.0.2
\n:construction_worker_man: Patch fixes
\n\n
\n- Fixes SSRF security vulnerability by doing a target-origin bypass in the proxy server in @happy-dom/server-renderer - By
\n@capricorn86v21.0.1
\n:construction_worker_man: Patch fixes
\n\n
\n- Adds aliases
\n--cssand--iframefor enabling CSS and iframe loading to @happy-dom/server-renderer - By@capricorn86v21.0.0
\n:bomb: Breaking Changes
\n\n
\n- Disables CSS and IFrame loading by default to prevent server-side request forgery (SSRF) - By
\n@capricorn86\n\n
\n- An attacker could embed
\n<iframe>or<link rel="stylesheet">elements in untrusted HTML to make Happy DOM send HTTP requests from the server to attacker-chosen URLs, including internal services. This could allow access to otherwise unreachable endpoints or trigger unintended actions, depending on the application and its network access.- The settings property
\ndisableCSSFileLoadinghas been deprecated- Added the new settings properties enableCSSFileLoading and enableIframePageLoading
\n- If you don't believe that you are at risk, you can keep the same behavior as in
\n<=v20.14.6by sending in{ enableCSSFileLoading: true, enableIframePageLoading: true }as broswer settings (e.g.new Window({ settings }));v20.14.6
\n:construction_worker_man: Patch fixes
\n\n
\n- Fixes cookie scope forgery vulnerability - By
\n@capricorn86v20.14.5
\n:construction_worker_man: Patch fixes
\n\n
\n- Preserve character references in comment data - By
\n@hampustagerudin task #2409v20.14.4
\n:construction_worker_man: Patch fixes
\n\n
\n- End comments at the first comment end tag when it overlaps a comment start tag - By
\n@hampustagerudin task #2407v20.14.3
\n:construction_worker_man: Patch fixes
\n\n
\n- Avoids cloning all properties in CSSPropertyManager.toString - By
\n@erictheswiftin task #2363v20.14.2
\n:construction_worker_man: Patch fixes
\n\n
\n- Fixes regression where not all CSS variables where resolved in
\ngetComputedStyle()- By@klaesrain task #2344v20.14.1
\n:construction_worker_man: Patch fixes
\n\n
\n- Invalidate the computed style cache for the whole subtree - By
\n@matmannionand@capricorn86in task #2366v20.14.0
\n\n
... (truncated)
\nfd16352 fix: Fixed a code injection vulnerability in the ESM compiler (#2537)75ab0fb fix: Fixed cross-origin isolation so opaque-origin data: iframes cannot acces...875ef5c fix: Fixes security vulnerability where authorization header was forwarded wh...1f3ffdf fix: Fixes SSRF security vulnerability by doing a target-origin bypass in the...f55c7e0 chore: Update security documentation (#2509)2b91e68 fix: Adds alias for enabling CSS and iframe loading in server-renderer (#2503)0a99c75 BREAKING CHANGE: Disables CSS and IFrame loading by default (#2502)f21dbd7 fix: Fixes cookie scope forgery vulnerability (#2477)0d4cdbe fix: #2409 Preserve character references in comment data (#2410)9c920a4 fix: #2407 End comments at the first comment end tag when it overlaps a com...Sourced from next's releases.
\n\n\nv16.4.1
\nThis release contains security fixes for the following advisories:
\nCritical:
\n\n
\n- Unauthenticated Remote Code Execution in
\nuse cachefunctions returning typed arrays- Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used
\nHigh:
\n\nv16.4.0
\nCheck out the 16.4 announcement post to get an overview of the changes.
\nCore Changes
\n\n
\n- Show compiler plugin warning in more situations: #75682
\n- fix(scripts): correct typo in rm.mjs error message: #87015
\n- docs: improve clarity and punctuation in README: #86096
\n- Fix debug build paths Pages Router support entries: #93529
\n- bundle-analyzer: record historical snapshots on each analyze run: #93520
\n- fix: detect proxy.ts correctly with compound pageExtensions: #93246
\n- feat(turbopack): support
\nfalsevalues forresolveAliasconfig: #93331Misc Changes
\n\n
\n\n- docs: correction to dynamicParams migration: #96624
\n- docs: proxy event argument: #96435
\n- docs: remove experimental note from runtime prefetching: #96615
\n- Preserve per-segment prefetching after dynamic navigation: #96583
\n- Rename static generation stream option to waitForAllReady: #96564
\n- Remove obsolete static generation plumbing: #96563
\n- [turbopack] Drop dead writes to
\nexports: #96381- [turbopack] Ignore writes to
\nexportsafter amodule.exports = {}writes: #96380- [turbopack] Add test for sideEffects with optimizePackageImports: #96549
\n- [turbopack] Strip leading BOM before parsing CSS: #96678
\n- Upgrade React from
\ncbb046ab-20260731to7dfc7ccd-20260803: #96550- docs: use relative doc links in instant-navigation error pages: #96672
\n- Turbopack: terminate failed plugin worker threads: #96592
\n- Fix HTML-limited bot matching in prerender bypass rules: #96584
\n- [ci] Fix create_release_branch for new repo permissions: #96641
\n- test: skip action module instance deploy test: #96629
\n- docs: quote the dynamicParams build error in a blockquote: #96633
\n- [react-sync] Open pull requests as the bot that authors the commits: #96682
\n- [Bench] Fixes for pure Fizz bench: #96771
\n- Derive foreground cache revalidation from the consumer: #96731
\n- Fix race when navigating Back before hydration: #96252
\n- docs: present each Skill as steps in the AI agents guide: #96751
\n- Reuse completed cache entries for the rest of a request: #96727
\n- Upgrade React from
\n7dfc7ccd-20260803to11eddecd-20260805: #96735- Remove WorkStore execution mode: #96674
\n
... (truncated)
\n7217011 v16.4.11798e42 [cd] Allow branch to get published9571ec8 [lts-active][next/image] Bump sharp (#234)a4cea6a [lts-active][react] Improve Server Component transport protocol (#193)8df0d97 [lts-active][test] Backport various deploy test fixes (#100114)ac9afcc [lts-active] Fix google tag manager e2e test, assume GTM 200s instead of 404i...e273d5b v16.4.0fdf41d6 [ai-upgrade] discover upgrade models and reasoning efforts from agent CLIs (#...c3e76ad v16.4.0-canary.6347c6cc8 Document next analyze export in the package bundling guide (#99735)Sourced from happy-dom's releases.
\n\n\nv21.0.4
\n:construction_worker_man: Patch fixes
\n\n
\n- Fixed a code injection vulnerability in the ESM compiler - By
\n@capricorn86- Fixed cross-origin isolation so opaque-origin
\ndata:iframes cannot access their parent or top window - By@capricorn86v21.0.3
\n:construction_worker_man: Patch fixes
\n\n
\n- Fixes security vulnerability where authorization header was forwarded when redirecting - By
\n@capricorn86v21.0.2
\n:construction_worker_man: Patch fixes
\n\n
\n- Fixes SSRF security vulnerability by doing a target-origin bypass in the proxy server in @happy-dom/server-renderer - By
\n@capricorn86v21.0.1
\n:construction_worker_man: Patch fixes
\n\n
\n- Adds aliases
\n--cssand--iframefor enabling CSS and iframe loading to @happy-dom/server-renderer - By@capricorn86v21.0.0
\n:bomb: Breaking Changes
\n\n
\n- Disables CSS and IFrame loading by default to prevent server-side request forgery (SSRF) - By
\n@capricorn86\n\n
\n- An attacker could embed
\n<iframe>or<link rel="stylesheet">elements in untrusted HTML to make Happy DOM send HTTP requests from the server to attacker-chosen URLs, including internal services. This could allow access to otherwise unreachable endpoints or trigger unintended actions, depending on the application and its network access.- The settings property
\ndisableCSSFileLoadinghas been deprecated- Added the new settings properties enableCSSFileLoading and enableIframePageLoading
\n- If you don't believe that you are at risk, you can keep the same behavior as in
\n<=v20.14.6by sending in{ enableCSSFileLoading: true, enableIframePageLoading: true }as broswer settings (e.g.new Window({ settings }));v20.14.6
\n:construction_worker_man: Patch fixes
\n\n
\n- Fixes cookie scope forgery vulnerability - By
\n@capricorn86v20.14.5
\n:construction_worker_man: Patch fixes
\n\n
\n- Preserve character references in comment data - By
\n@hampustagerudin task #2409v20.14.4
\n:construction_worker_man: Patch fixes
\n\n
\n- End comments at the first comment end tag when it overlaps a comment start tag - By
\n@hampustagerudin task #2407v20.14.3
\n:construction_worker_man: Patch fixes
\n\n
\n- Avoids cloning all properties in CSSPropertyManager.toString - By
\n@erictheswiftin task #2363v20.14.2
\n:construction_worker_man: Patch fixes
\n\n
\n- Fixes regression where not all CSS variables where resolved in
\ngetComputedStyle()- By@klaesrain task #2344v20.14.1
\n:construction_worker_man: Patch fixes
\n\n
\n- Invalidate the computed style cache for the whole subtree - By
\n@matmannionand@capricorn86in task #2366v20.14.0
\n\n
... (truncated)
\nfd16352 fix: Fixed a code injection vulnerability in the ESM compiler (#2537)75ab0fb fix: Fixed cross-origin isolation so opaque-origin data: iframes cannot acces...875ef5c fix: Fixes security vulnerability where authorization header was forwarded wh...1f3ffdf fix: Fixes SSRF security vulnerability by doing a target-origin bypass in the...f55c7e0 chore: Update security documentation (#2509)2b91e68 fix: Adds alias for enabling CSS and iframe loading in server-renderer (#2503)0a99c75 BREAKING CHANGE: Disables CSS and IFrame loading by default (#2502)f21dbd7 fix: Fixes cookie scope forgery vulnerability (#2477)0d4cdbe fix: #2409 Preserve character references in comment data (#2410)9c920a4 fix: #2407 End comments at the first comment end tag when it overlaps a com...Sourced from next's releases.
\n\n\nv16.4.1
\nThis release contains security fixes for the following advisories:
\nCritical:
\n\n
\n- Unauthenticated Remote Code Execution in
\nuse cachefunctions returning typed arrays- Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used
\nHigh:
\n\nv16.4.0
\nCheck out the 16.4 announcement post to get an overview of the changes.
\nCore Changes
\n\n
\n- Show compiler plugin warning in more situations: #75682
\n- fix(scripts): correct typo in rm.mjs error message: #87015
\n- docs: improve clarity and punctuation in README: #86096
\n- Fix debug build paths Pages Router support entries: #93529
\n- bundle-analyzer: record historical snapshots on each analyze run: #93520
\n- fix: detect proxy.ts correctly with compound pageExtensions: #93246
\n- feat(turbopack): support
\nfalsevalues forresolveAliasconfig: #93331Misc Changes
\n\n
\n\n- docs: correction to dynamicParams migration: #96624
\n- docs: proxy event argument: #96435
\n- docs: remove experimental note from runtime prefetching: #96615
\n- Preserve per-segment prefetching after dynamic navigation: #96583
\n- Rename static generation stream option to waitForAllReady: #96564
\n- Remove obsolete static generation plumbing: #96563
\n- [turbopack] Drop dead writes to
\nexports: #96381- [turbopack] Ignore writes to
\nexportsafter amodule.exports = {}writes: #96380- [turbopack] Add test for sideEffects with optimizePackageImports: #96549
\n- [turbopack] Strip leading BOM before parsing CSS: #96678
\n- Upgrade React from
\ncbb046ab-20260731to7dfc7ccd-20260803: #96550- docs: use relative doc links in instant-navigation error pages: #96672
\n- Turbopack: terminate failed plugin worker threads: #96592
\n- Fix HTML-limited bot matching in prerender bypass rules: #96584
\n- [ci] Fix create_release_branch for new repo permissions: #96641
\n- test: skip action module instance deploy test: #96629
\n- docs: quote the dynamicParams build error in a blockquote: #96633
\n- [react-sync] Open pull requests as the bot that authors the commits: #96682
\n- [Bench] Fixes for pure Fizz bench: #96771
\n- Derive foreground cache revalidation from the consumer: #96731
\n- Fix race when navigating Back before hydration: #96252
\n- docs: present each Skill as steps in the AI agents guide: #96751
\n- Reuse completed cache entries for the rest of a request: #96727
\n- Upgrade React from
\n7dfc7ccd-20260803to11eddecd-20260805: #96735- Remove WorkStore execution mode: #96674
\n
... (truncated)
\n7217011 v16.4.11798e42 [cd] Allow branch to get published9571ec8 [lts-active][next/image] Bump sharp (#234)a4cea6a [lts-active][react] Improve Server Component transport protocol (#193)8df0d97 [lts-active][test] Backport various deploy test fixes (#100114)ac9afcc [lts-active] Fix google tag manager e2e test, assume GTM 200s instead of 404i...e273d5b v16.4.0fdf41d6 [ai-upgrade] discover upgrade models and reasoning efforts from agent CLIs (#...c3e76ad v16.4.0-canary.6347c6cc8 Document next analyze export in the package bundling guide (#99735)Sourced from objectstack-ai/objectstack/.github/actions/half-state-patrol's changelog.
\n\n\nChangelog
\nAll notable changes to the ObjectStack Protocol will be documented in this file.
\nThe format is based on Keep a Changelog,\nand this project adheres to Semantic Versioning.
\n\n\nWhere release history now lives. The platform ships as one version-locked\ntrain (changesets
\nfixedgroup), so the update history is maintained in three\nlayers rather than by hand-editing this file:\n
\n- Per-package detail — each package's
\nCHANGELOG.mdis generated by\nchangesets from the.changeset/\nentries every PR adds (including@objectstack/console, which now carries a\nchangeset for each bundled objectui/frontend bump).- Platform, developer-facing narrative — the curated per-major pages under\n
\nhttps://github.com/objectstack-ai/objectstack/blob/main/content/docs/releases/lead with breaking changes +\nmigration and cover backend and Console (frontend). Start there.- This file is retained for its historical entries. The
\n[Unreleased]\nbacklog below predates the per-major release pages; its items are released in\n12.x–14.x and are being migrated into those pages — prefer them for anything\nnew. Seedocs/releases-maintenance.mdfor the full maintenance model.[Unreleased]
\nChanged — Security: anonymous access denied by default (BREAKING) + destructive-op RBAC gates
\n\n
\n- \n
api.requireAuthnow defaults totrue(ADR-0056 D2 flip): anonymous\nrequests to/data/*CRUD + batch endpoints are rejected with HTTP 401\nunless the deployment explicitly opts out withapi: { requireAuth: false }\n(the REST plugin logs a boot warning for the explicit opt-out). Share-links,\npublic forms (via the declaration-derivedpublicFormGrant), and the\ncontrol plane (/auth,/health,/discovery) keep working with no\naction.objectstack servepasses an explicitfalseonly for stacks with\nnoauthtier (nothing could authenticate against them). Conformance row\nrequireAuth-default-flip→enforced.- \n
transfer/restore/purgeare RBAC-gated ahead of the ops (#1883):\nthe permission evaluator maps them toallowTransfer/allowRestore/\nallowPurge(with themodifyAllRecordssuper-user bypass), so when the\nM2 operations ship there is no ungated window. Unmapped destructive\noperations keep failing closed (ADR-0049).Added — ObjectUI one-month frontend scan + backend alignment summary
\nScanning
\n\n../objectuifrom 2026-05-08 through 2026-06-08 shows a broad Studio\nand renderer push, not just the most recent commits. Major frontend changes\ninclude live field-level conditional rules in forms (visibleWhen,\nreadonlyWhen,requiredWhen), row-scoped inline-grid rules,\nrequired-on-submit handling, spreadsheet-style master-detail line-item editing,\natomic parent+child form saves, derived related lists, record-page authoring,
... (truncated)
\nba9e0c3 ci: pin credential-holding third-party actions by sha, and pass the Turbo cac...35d5060 refactor(plugin-auth): move the createAuthInstance body into auth-manager-aut...1361a5a fix(rest)!: compare the credential's environment with the resolved environmen...025f6de docs(spec): the runAs description names a system run's refused identity-assig...6abee03 fix(plugin-auth, driver-sql)!: fail closed on a missing auth secret outside d...ce18e73 fix(metadata-protocol): a widget probe refused by read admission names the ca...9c43e19 docs(releases): fold #25541, #25550 and #25429 into the 18.1.0 notes (#25562)041a120 feat(pm): the queue guard refuses a project-thread Tier S record reviewed fro...03243fc ci: prune each Test Core Turbo seed to its own run's tasks before saving it (...0949fe5 docs(skills): objectstack-data's security rules name the risk of renaming or ...Sourced from changesets/action's releases.
\n\n\nv2.1.2
\nPatch Changes
\n\n
\n- \n
\n#735
\n8833883Thanks@bluwy! - Handle error when pushing git tags with the git CLI- \n\n
\n- \n
\n#724
\n36f529fThanks@bluwy! - Fix root action double error logs- \n
\n#729
\nca85897Thanks@bluwy! - Always switch and reset branch when generating version commits, similar to ifpush-with-git-cliis enabledv2.1.1
\nPatch Changes
\n\n
\n- #721
\nda1ea29Thanks@KEBABSELLER6! - Fixed typo in renamed inputs from v1 to v2v2.1.0
\nMinor Changes
\n\n
\n- #718
\n3b7c71cThanks@bluwy! - Add acwdinput to the root action,/select-mode,/version,/pack, and/publishsub-actions to set the current working directory to execute Changesets in. This input existed in v1 but was incorrectly removed.Patch Changes
\n\nv2.0.0
\nMajor Changes
\n\n
\n\n- \n
\n#692
\ncb3f011Thanks@Andarist! - Release commits and tags are now pushed using the GitHub API by default.Replace the
\ncommit-modeinput with the booleanpush-with-git-cliinput. Setpush-with-git-cli: trueto continue using the Git CLI.Regardless of the push mode, custom GitHub tokens must be passed explicitly through the
\ngithub-tokeninput. TheGITHUB_TOKENenvironment variable and credentials configured byactions/checkoutor embedded in remote URLs are not substitutes for this input. When the Git CLI is enabled,github-tokentakes precedence over those repository credentials.- \n
\n#680
\nca57073Thanks@bluwy! - Add a newpush-git-tagsoption that complementscreate-github-releasesto control specifically if git tags should be created but not GitHub releases.If
\ncreate-github-releaseswas previously set tofalse, which also indirectly disabled git tag creation, git tags will now be created instead by default. If this is not desired, setpush-git-tagstofalseexplicitly.- \n
\n#657
\n4f718b5Thanks@Andarist! - Removed compatibility support for old Changesets v1.- \n
\n#681
\n7359107Thanks@bluwy! - Rename the root action inputs and outputs to better match the sub-actions' conventions.Inputs:
\n\n
\n- \n
version->version-script- \n
publish->publish-script- \n
commit->commit-message- \n
title->pr-title- \n
branch->pr-base-branch
... (truncated)
\nSourced from changesets/action's changelog.
\n\n\n\n
@changesets/action2.1.2
\nPatch Changes
\n\n
\n- \n
\n#735
\n8833883Thanks@bluwy! - Handle error when pushing git tags with the git CLI- \n\n
\n- \n
\n#724
\n36f529fThanks@bluwy! - Fix root action double error logs- \n
\n#729
\nca85897Thanks@bluwy! - Always switch and reset branch when generating version commits, similar to ifpush-with-git-cliis enabled2.1.1
\nPatch Changes
\n\n
\n- #721
\nda1ea29Thanks@KEBABSELLER6! - Fixed typo in renamed inputs from v1 to v22.1.0
\nMinor Changes
\n\n
\n- #718
\n3b7c71cThanks@bluwy! - Add acwdinput to the root action,/select-mode,/version,/pack, and/publishsub-actions to set the current working directory to execute Changesets in. This input existed in v1 but was incorrectly removed.Patch Changes
\n\n2.0.0
\nMajor Changes
\n\n
\n\n- \n
\n#692
\ncb3f011Thanks@Andarist! - Release commits and tags are now pushed using the GitHub API by default.Replace the
\ncommit-modeinput with the booleanpush-with-git-cliinput. Setpush-with-git-cli: trueto continue using the Git CLI.Regardless of the push mode, custom GitHub tokens must be passed explicitly through the
\ngithub-tokeninput. TheGITHUB_TOKENenvironment variable and credentials configured byactions/checkoutor embedded in remote URLs are not substitutes for this input. When the Git CLI is enabled,github-tokentakes precedence over those repository credentials.- \n
\n#680
\nca57073Thanks@bluwy! - Add a newpush-git-tagsoption that complementscreate-github-releasesto control specifically if git tags should be created but not GitHub releases.If
\ncreate-github-releaseswas previously set tofalse, which also indirectly disabled git tag creation, git tags will now be created instead by default. If this is not desired, setpush-git-tagstofalseexplicitly.- \n
\n#657
\n4f718b5Thanks@Andarist! - Removed compatibility support for old Changesets v1.- \n
\n#681
\n7359107Thanks@bluwy! - Rename the root action inputs and outputs to better match the sub-actions' conventions.Inputs:
\n
... (truncated)
\nae32849 v2.1.20138f45 Version Packages (#726)8833883 Handle error when pushing git tags with the git CLI (#735)e08fde7 Improve log messages (#730)371fd77 Bump human-id in the production-dependencies group across 1 directory (#732)85efcaf Bump actions/checkout in the github-actions group across 1 directory (#734)5bb9d5c Bump the development-dependencies group across 1 directory with 7 updates (#733)ca85897 Always prepare branch for version (#729)36f529f Fix root action double error logs (#724)d7669c8 Version Packages (#722)