From 5e52e08ba036bb927ecb1b13f7bc3e8e4b280ab1 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Tue, 15 Sep 2026 16:35:10 +0000 Subject: [PATCH 1/2] chore(release): 1.1.1 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Prepared by scripts/prepare-release.mjs. Merging this PR (any merge method) triggers this workflow's PUBLISH mode, which tags, publishes to npm, and creates the GitHub release — nothing publishes until this merges. --- CHANGELOG.md | 8 ++++++++ package-lock.json | 4 ++-- package.json | 2 +- 3 files changed, 11 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index f4ba8a0..23d390a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,11 @@ +## [1.1.1](https://github.com/WYRE-AI/node-halopsa/compare/v1.1.0...v1.1.1) (2026-09-15) + + +### Bug Fixes + +* **deps:** resolve js-yaml CVE-2026-84375 ([#83](https://github.com/WYRE-AI/node-halopsa/issues/83)) ([8e7a7b1](https://github.com/WYRE-AI/node-halopsa/commit/8e7a7b191407c20a04176d2fb6d0accee744efbf)) + + ## [Unreleased] ### Security diff --git a/package-lock.json b/package-lock.json index 839f170..f2cc446 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "@wyre-ai/node-halopsa", - "version": "1.1.0", + "version": "1.1.1", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "@wyre-ai/node-halopsa", - "version": "1.1.0", + "version": "1.1.1", "license": "Apache-2.0", "devDependencies": { "@eslint/js": "^10.0.1", diff --git a/package.json b/package.json index 386ae41..4ac3660 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@wyre-ai/node-halopsa", - "version": "1.1.0", + "version": "1.1.1", "publishConfig": { "registry": "https://npm.pkg.github.com" }, From fe4c9d79eb23142bc258f3ed0995cf07393bb579 Mon Sep 17 00:00:00 2001 From: wyre-agent-fleet Date: Thu, 17 Sep 2026 12:37:32 +0000 Subject: [PATCH 2/2] docs(changelog): remove duplicate js-yaml CVE entry per CodeRabbit review The Unreleased/Security entry described the same fix already released under 1.1.1 above it -- removed, nothing else was under Unreleased. --- CHANGELOG.md | 6 ------ 1 file changed, 6 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 23d390a..a7fb57c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,12 +6,6 @@ * **deps:** resolve js-yaml CVE-2026-84375 ([#83](https://github.com/WYRE-AI/node-halopsa/issues/83)) ([8e7a7b1](https://github.com/WYRE-AI/node-halopsa/commit/8e7a7b191407c20a04176d2fb6d0accee744efbf)) -## [Unreleased] - -### Security - -- **Resolved js-yaml high-severity advisory CVE-2026-84375** (fixed in js-yaml >= 4.3.2). js-yaml is only a transitive devDependency, pulled on the 4.x line via `cosmiconfig`. Added a scoped npm `override` (`cosmiconfig` → `js-yaml ^4.3.2`) to force the patched line. `npm audit` reports 0 vulnerabilities. - # [1.1.0](https://github.com/WYRE-AI/node-halopsa/compare/v1.0.13...v1.1.0) (2026-09-04)