Skip to content

Commit 17708d8

Browse files
github-actions[bot]github-actions[bot]
authored
chore(release): version packages (#51)
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
1 parent 440e0af commit 17708d8

10 files changed

Lines changed: 81 additions & 29 deletions

File tree

‎.changeset/fix-csrf-fetch-request-headers.md‎

Lines changed: 0 additions & 10 deletions
This file was deleted.

‎.changeset/security-vite-unhead.md‎

Lines changed: 0 additions & 15 deletions
This file was deleted.

‎packages/core/CHANGELOG.md‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,19 @@
11
# @csrf-armor/core
22

3+
## 1.2.3
4+
5+
### Patch Changes
6+
7+
- [#52](https://github.com/muneebs/csrf-armor/pull/52) [`440e0af`](https://github.com/muneebs/csrf-armor/commit/440e0af0a55bf2b3c93e26d031ea31a40540ad43) Thanks [@muneebs](https://github.com/muneebs)! - chore(deps): patch transitive dev dependency security advisories
8+
9+
Bumps pnpm overrides for `vite` (`^6.4.1` → `^6.4.2`) and `unhead` (`>=2.1.11` → `>=2.1.13`) to pull in patched versions. These are dev/build-time dependencies only — no runtime behavior or published API changes.
10+
11+
Addresses:
12+
13+
- GHSA: Vite arbitrary file read via dev server WebSocket (high, <=6.4.1)
14+
- GHSA: Vite path traversal in optimized deps `.map` handling (medium, <=6.4.1)
15+
- GHSA: Unhead `hasDangerousProtocol()` bypass via leading-zero padded HTML entities in `useHeadSafe()` (medium, <2.1.13)
16+
317
## 1.2.2
418

519
### Patch Changes

‎packages/core/package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "@csrf-armor/core",
3-
"version": "1.2.2",
3+
"version": "1.2.3",
44
"description": "Framework-agnostic CSRF protection core functionality",
55
"type": "module",
66
"main": "./dist/index.mjs",

‎packages/express/CHANGELOG.md‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,22 @@
11
# @csrf-armor/express
22

3+
## 1.2.3
4+
5+
### Patch Changes
6+
7+
- [#52](https://github.com/muneebs/csrf-armor/pull/52) [`440e0af`](https://github.com/muneebs/csrf-armor/commit/440e0af0a55bf2b3c93e26d031ea31a40540ad43) Thanks [@muneebs](https://github.com/muneebs)! - chore(deps): patch transitive dev dependency security advisories
8+
9+
Bumps pnpm overrides for `vite` (`^6.4.1` → `^6.4.2`) and `unhead` (`>=2.1.11` → `>=2.1.13`) to pull in patched versions. These are dev/build-time dependencies only — no runtime behavior or published API changes.
10+
11+
Addresses:
12+
13+
- GHSA: Vite arbitrary file read via dev server WebSocket (high, <=6.4.1)
14+
- GHSA: Vite path traversal in optimized deps `.map` handling (medium, <=6.4.1)
15+
- GHSA: Unhead `hasDangerousProtocol()` bypass via leading-zero padded HTML entities in `useHeadSafe()` (medium, <2.1.13)
16+
17+
- Updated dependencies [[`440e0af`](https://github.com/muneebs/csrf-armor/commit/440e0af0a55bf2b3c93e26d031ea31a40540ad43)]:
18+
- @csrf-armor/core@1.2.3
19+
320
## 1.2.2
421

522
### Patch Changes

‎packages/express/package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "@csrf-armor/express",
3-
"version": "1.2.2",
3+
"version": "1.2.3",
44
"description": "Express.js adapter for CSRF Armor - Advanced CSRF protection for Express.js applications",
55
"type": "module",
66
"types": "./dist/index.d.ts",

‎packages/nextjs/CHANGELOG.md‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,28 @@
11
# @csrf-armor/nextjs
22

3+
## 1.4.3
4+
5+
### Patch Changes
6+
7+
- [#50](https://github.com/muneebs/csrf-armor/pull/50) [`7d4adeb`](https://github.com/muneebs/csrf-armor/commit/7d4adebc94ceb1f01a6af0807b7a5f0c7a92b1f0) Thanks [@muneebs](https://github.com/muneebs)! - fix(client): preserve headers when `csrfFetch` is called with a `Request` object
8+
9+
`csrfFetch` previously only read headers from the `init` argument, so when it was called with a full `Request` object (e.g. `csrfFetch(new Request(url, { headers }))`), the Request's headers were stripped. It now merges headers from the Request, then the `init` argument, then the CSRF headers (CSRF headers always take precedence), making `csrfFetch` a drop-in replacement for `fetch`.
10+
11+
Fixes #49
12+
13+
- [#52](https://github.com/muneebs/csrf-armor/pull/52) [`440e0af`](https://github.com/muneebs/csrf-armor/commit/440e0af0a55bf2b3c93e26d031ea31a40540ad43) Thanks [@muneebs](https://github.com/muneebs)! - chore(deps): patch transitive dev dependency security advisories
14+
15+
Bumps pnpm overrides for `vite` (`^6.4.1` → `^6.4.2`) and `unhead` (`>=2.1.11` → `>=2.1.13`) to pull in patched versions. These are dev/build-time dependencies only — no runtime behavior or published API changes.
16+
17+
Addresses:
18+
19+
- GHSA: Vite arbitrary file read via dev server WebSocket (high, <=6.4.1)
20+
- GHSA: Vite path traversal in optimized deps `.map` handling (medium, <=6.4.1)
21+
- GHSA: Unhead `hasDangerousProtocol()` bypass via leading-zero padded HTML entities in `useHeadSafe()` (medium, <2.1.13)
22+
23+
- Updated dependencies [[`440e0af`](https://github.com/muneebs/csrf-armor/commit/440e0af0a55bf2b3c93e26d031ea31a40540ad43)]:
24+
- @csrf-armor/core@1.2.3
25+
326
## 1.4.2
427

528
### Patch Changes

‎packages/nextjs/package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "@csrf-armor/nextjs",
3-
"version": "1.4.2",
3+
"version": "1.4.3",
44
"description": "CSRF protection middleware for Next.js applications",
55
"type": "module",
66
"main": "./dist/index.js",

‎packages/nuxt/CHANGELOG.md‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,28 @@
11
# @csrf-armor/nuxt
22

3+
## 1.1.2
4+
5+
### Patch Changes
6+
7+
- [#50](https://github.com/muneebs/csrf-armor/pull/50) [`7d4adeb`](https://github.com/muneebs/csrf-armor/commit/7d4adebc94ceb1f01a6af0807b7a5f0c7a92b1f0) Thanks [@muneebs](https://github.com/muneebs)! - fix(client): preserve headers when `csrfFetch` is called with a `Request` object
8+
9+
`csrfFetch` previously only read headers from the `init` argument, so when it was called with a full `Request` object (e.g. `csrfFetch(new Request(url, { headers }))`), the Request's headers were stripped. It now merges headers from the Request, then the `init` argument, then the CSRF headers (CSRF headers always take precedence), making `csrfFetch` a drop-in replacement for `fetch`.
10+
11+
Fixes #49
12+
13+
- [#52](https://github.com/muneebs/csrf-armor/pull/52) [`440e0af`](https://github.com/muneebs/csrf-armor/commit/440e0af0a55bf2b3c93e26d031ea31a40540ad43) Thanks [@muneebs](https://github.com/muneebs)! - chore(deps): patch transitive dev dependency security advisories
14+
15+
Bumps pnpm overrides for `vite` (`^6.4.1` → `^6.4.2`) and `unhead` (`>=2.1.11` → `>=2.1.13`) to pull in patched versions. These are dev/build-time dependencies only — no runtime behavior or published API changes.
16+
17+
Addresses:
18+
19+
- GHSA: Vite arbitrary file read via dev server WebSocket (high, <=6.4.1)
20+
- GHSA: Vite path traversal in optimized deps `.map` handling (medium, <=6.4.1)
21+
- GHSA: Unhead `hasDangerousProtocol()` bypass via leading-zero padded HTML entities in `useHeadSafe()` (medium, <2.1.13)
22+
23+
- Updated dependencies [[`440e0af`](https://github.com/muneebs/csrf-armor/commit/440e0af0a55bf2b3c93e26d031ea31a40540ad43)]:
24+
- @csrf-armor/core@1.2.3
25+
326
## 1.1.1
427

528
### Patch Changes

‎packages/nuxt/package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "@csrf-armor/nuxt",
3-
"version": "1.1.1",
3+
"version": "1.1.2",
44
"description": "Nuxt module for CSRF protection powered by csrf-armor",
55
"type": "module",
66
"license": "MIT",

0 commit comments

Comments
 (0)