chore(release): 1.1.1

[wyre-agent-fleet]

Automated release PR. Merging this (any merge method) publishes 1.1.1 to npm and creates the GitHub release — see CHANGELOG.md in this diff for the notes.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

Summary by CodeRabbit

• Security

  • Resolved dependency security vulnerabilities, including issues affecting Vitest and js-yaml.

• Release

  • Updated the package version to 1.1.1.
  • Added release notes for the September 15, 2026 release.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: c5c1629e-f3ad-43dd-bc03-6f66f0dffca7

📥 Commits

Reviewing files that changed from the base of the PR and between 358442e and b541999.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json, !**/package-lock.json

📒 Files selected for processing (2)

• CHANGELOG.md
• package.json

Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

📝 Walkthrough

Walkthrough

The package version changes from 1.1.0 to 1.1.1. The changelog adds the September 15, 2026 release entry and records Vitest and js-yaml security fixes.

Changes

Release metadata

Layer / File(s)	Summary
Version and changelog update package.json, CHANGELOG.md	The package version changes to 1.1.1. The changelog records the release date and security fixes for Vitest and js-yaml.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Suggested reviewers: asachs01

Merge Risk: ⚪ Minimal · up to b5419

The release metadata follows the repository’s established semantic-release layout and is mergeable.

🚥 Pre-merge checks | ✅ 6

✅ Passed checks (6 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the release preparation and version 1.1.1, which matches the package version update and changelog entry.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Changelog Entry	✅ Passed	The PR is a release-metadata update only. The diff changes the version from 1.1.0 to 1.1.1, updates matching lockfile metadata, and adds the 1.1.1 release notes. It changes no runtime code, public API…

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch release/next

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch release/next

---

_{Comment @coderabbitai help to get the list of available commands.}

[asachs01]

Hermes Agent Review

Verdict: Approve — trivial automated release PR.

Changes are limited to CHANGELOG.md, package.json, and package-lock.json bumping to 1.1.1 (vitest CVE-2026-84373 fix landed in the referenced dep bump PR #83). No application logic touched here.

Correctness

• Version bump is consistent across package.json and package-lock.json.
• Changelog entry correctly references the fixing commit/PR.

Security

• No new code paths; this just packages the already-merged vitest CVE fix for release.

Looks Good

• Standard semantic-release automation, safe to merge to publish 1.1.1.

---

Reviewed by Hermes Agent

[asachs01]

Code Review Summary (Hermes Agent)

Verdict: Approve — mechanical release PR (semantic-release), CHANGELOG + version bump only, no logic changes. Bumps vitest for CVE-2026-84373 per #83.

Reviewed by Hermes Agent.

[asachs01]

Review: release 1.1.1 (fresh review — new commits since prior run)

Verdict: approve

Standard automated semantic-release PR: version bump 1.1.0 → 1.1.1 in package.json/package-lock.json, plus generated CHANGELOG.md entry. No source code changes.

Correctness vs. title: "chore(release): 1.1.1" — confirmed, manifest and lockfile versions match.

Content check: CHANGELOG documents two dependency security fixes — Vitest bump for CVE-2026-84373 (#83) and js-yaml bump for CVE-2026-84375 (#86) — consistent with commit hashes and issue references shown.

Security: No hardcoded secrets/credentials introduced. This PR itself is fixing two CVEs in dependencies, which is a net security improvement.

Tests/CI: No test changes needed for a version-only release PR.

No blocking issues found. Diff is minimal and matches its stated purpose.

[asachs01]

Hermes Agent Review

Verdict: Approve (automated release PR, CHANGELOG/version bump only)

Looks Good

• Diff is limited to CHANGELOG.md, package.json, package-lock.json — no source changes.
• Version bump 1.1.0 → 1.1.1 correctly reflects the two CVE dependency fixes (Vitest CVE-2026-84373, js-yaml CVE-2026-84375) already merged in fix(deps): bump vitest to resolve CVE-2026-84373 #83/fix(deps): resolve js-yaml CVE-2026-84375 #86.
• No risk to review here beyond confirming version/lockfile consistency, which checks out.

[asachs01]

Code Review Summary (Hermes Agent)

Verdict: Approve

Standard semantic-release chore PR: CHANGELOG.md, package.json, package-lock.json version bump 1.1.0 -> 1.1.1, dependency CVE fixes already merged upstream (#83 vitest CVE-2026-84373, #86 js-yaml CVE-2026-84375). No new code, no manual edits — auto-generated release commit. No issues found.

---

Reviewed by Hermes Agent