chore(deps)(deps): bump the major-dependencies group across 1 directory with 13 updates by dependabot[bot] · Pull Request #134 · airlinklabs/panel

dependabot · 2026-09-27T22:39:42Z

Bumps the major-dependencies group with 13 updates in the / directory:

Package	From	To
@dicebear/core	`9.4.3`	`10.7.0`
@simplewebauthn/browser	`13.3.0`	`14.0.0`
@simplewebauthn/server	`13.3.3`	`14.0.3`
@xterm/xterm	`5.5.0`	`6.0.0`
boxen	`8.0.1`	`9.0.0`
chalk	`5.6.2`	`6.0.1`
connect-redis	`9.0.0`	`10.0.0`
dotenv	`17.4.2`	`18.0.4`
ioredis	`5.11.1`	`6.0.0`
nodemailer	`9.1.1`	`10.0.11`
@types/node	`25.9.5`	`26.6.3`
typescript	`6.0.3`	`7.0.2`
vitest	`4.1.11`	`5.0.2`

Updates @dicebear/core from 9.4.3 to 10.7.0

Release notes

Sourced from @dicebear/core's releases.

DiceBear 10.7 - Release Notes

DiceBear 10.7 adds six new styles and takes the collection from 55 to 61. It also adds a seventh language: the core runs in C# now, which is what a Godot or Unity game needs to draw an avatar without asking a server first.

🎨 Six new avatar styles

All six ship in @dicebear/styles 10.6.0 as DiceBear originals under CC0 1.0, so use them wherever you want, commercial projects included, no attribution needed.

Cameo

A head with hair and a mouth, and no eyes at all. Everything is painted in one body color under a translucent black or white overlay, so a portrait holds a single hue in two tones.

Gaze

A pair of eyes on a colored body, and nothing else. Eleven silhouettes, eleven eye pairs, five spacings, and the eyes take whichever ink holds up against the body color.

Gaze is the only animated one of the six, which brings that count to 19 of 61. Switch it on with animationVariant or tags=animation, and the eyes wander and blink while the body hops:

Marbles

A small face on a colored sphere. Three blurred ellipses do the shading, so the ball reads as round without a single gradient definition, and twenty tops cover hats, headphones, hair, a bow and an antenna.

Shadows

A bust as one filled silhouette, all of it in a single ink on a pale ground. The hat or the hairstyle sits behind the head, so the two merge into one outline.

Slice

One silhouette, cut into three to six horizontal bands that shift sideways against each other. Each band carries a different amount of white over the body color, so the shape runs through one hue from light to dark.

Stack

A balanced pile of stones. Eleven layouts set how many stones lie on each other and how far they lean, and each one squashes one of seven stone shapes to its own width and height.

🎮 The core in C#

... (truncated)

Changelog

Sourced from @dicebear/core's changelog.

[10.7.0] - 2026-08-26

Changed

Styles: Bumped @dicebear/styles to 10.6.0 for the CLI, the docs, and the editor. The release adds cameo, gaze, marbles, shadows, slice, and stack, which take the collection from 55 to 61 styles. gaze is animated, which takes that count from 18 to 19. Each of the six has a style page with its own preview row and a preset gallery, and the four the docs list under Characters are in the editor too.

Editor: Option labels can now differ per style. They are one flat map per language, because an option key almost always means the same thing wherever it appears. German was the exception: it gave the head and the piece sitting on top of it the same word, "Kopf", in bottts and croodles, which put two identical tabs in one strip, while English and Portuguese already told the two apart. A style that needs a different word now overrides that one label under styles.<styleName> in the message file, and only the language that deviates carries an override. marbles and cameo took one too, for a highlight that German and Portuguese called a flower and for a body color on a style that draws no body. npm run validate:messages now fails the build on a missing label, on two keys resolving to the same word inside one style, and on an override whose key or style is gone.

Fixed

Core (C#): Validation and rendering now agree with the other cores in several places where 10.7.0-rc.1 did not. Schema patterns are rewritten before they are compiled, because .NET reads $ as matching before a trailing newline and narrows \s to ASCII, which let a trailing newline through every anchored pattern and let non-ASCII whitespace past the javascript: and url() filters. A seed or title holding an unpaired surrogate keeps it instead of becoming U+FFFD, which used to produce a different avatar. The JSON envelope writes supplementary-plane characters literally. Avatar.FromJson rejects JSON that is not an object. A component that references itself raises CircularComponentReferenceException instead of overflowing the stack.

The color helpers are no longer public. DiceBear.Color collided with Godot.Color, UnityEngine.Color and System.Drawing.Color, so a file with using DiceBear; stopped compiling. This is a breaking change for anyone on 10.7.0-rc.1 who called them.

[10.7.0-rc.1] - 2026-08-22

Added

Core: A C# port, published to NuGet as DiceBear.Core. It renders SVG byte-identical to the JavaScript reference and the PHP, Python, Rust, Go, and Dart ports, and runs the shared parity fixtures to prove it. The package targets netstandard2.0 and net8.0, which covers .NET 8 and newer, .NET

... (truncated)

Commits

e870a5a v10.7.0
b5bb252 feat: add the six styles from 10.6.0 to the docs and the editor
15eb533 docs: give Godot and Unity their own framework guides
918fd7f chore: deploy the website only on demand
a153f97 fix: move to schema 1.5.1 and drop the pattern workarounds
6a44369 fix: match the reference's ASCII word boundary when randomizing ids
9ec2776 perf(csharp): cut the allocations out of the render path
5ee386e chore: fix the C# contributor commands and narrow the prettier ignore
0063b39 docs: count seven languages after the C# port
9a5fca7 fix(csharp): match the reference on schema patterns, unicode and recursion
Additional commits viewable in compare view

Updates @simplewebauthn/browser from 13.3.0 to 14.0.0

Release notes

Sourced from @simplewebauthn/browser's releases.

v14.0.0 - The one after they go quantum

The headlining feature of this release is @simplewebauthn/server gaining support for passkeys using the ML-DSA-44, ML-DSA-65, and ML-DSA-87 PQC algorithms in supported runtimes. And in those same supported runtimes, SimpleWebAuthn will automatically encourage registration of ML-DSA-44 passkeys to future-proof Relying Parties as PQC-capable FIDO2 authenticators and credential managers start coming to market. See https://simplewebauthn.dev/docs/advanced/server/pqc-ml-dsa-support for more info 🚀

Setting our sites on the browser, @simplewebauthn/browser picks up a new sendSignal() method as a single method to call all of the WebAuthn Signal APIs. See https://simplewebauthn.dev/docs/packages/browser#sendsignal for more info 🛜

As for breaking changes, the minimum supported version of Node has been raised to Node LTS 22.x and higher, and Deno v2.4.x and higher. Going forward, SimpleWebAuthn will more formally aim to support Node LTS releases through their Active and Maintenance windows as tracked on the Node.js Releases page, and aim to support Deno minor releases for up to one year after their release

That's not all, though. Continue reading for the full list of changes in this release! 🎉

Changes:

[server] The PQC ML-DSA-44, ML-DSA-65, and ML-DSA-87 signature algorithms are now supported as passkey public key algorithms when the runtime supports them. In runtimes that support these PQC algorithms, generateRegistrationOptions() will include ML-DSA-44 as the most preferred public key algorithm during registration. See https://simplewebauthn.dev/docs/advanced/server/pqc-ml-dsa-support for more info (#785, #794)

[browser] The new sendSignal() method offers a simple way to invoke the WebAuthn Signal APIs. See https://simplewebauthn.dev/docs/packages/browser#sendsignal for more info (#778)

[browser] The new browserSupportsPasskeys() helper method performs more robust WebAuthn support detection by also checking for typical passkey-related WebAuthn features. See https://simplewebauthn.dev/docs/packages/browser#browsersupportspasskeys for more info (#761)

[browser] The new getBrowserCapabilities() helper method wraps WebAuthn's getClientCapabilities() with additional feature detection checks when possible. See https://simplewebauthn.dev/docs/packages/browser#getbrowsercapabilities for more info (#761)

[server] verifyAuthenticationResponse() accepts an optional new expectedTopOrigin argument that supports cross-origin authentication verification. See https://simplewebauthn.dev/docs/advanced/server/cross-origin-support for more info (#773, h/t @agektmr)

[server] MetadataService.initialize() accepts an optional new logger argument that can be used to capture MetadataService status output in a project-specific manner. See https://simplewebauthn.dev/docs/advanced/server/metadata-service#logging for more info (#765)

[server] The typing of transports in excludeCredentials when calling generateRegistrationOptions(), and allowCredentials when calling generateAuthenticationOptions(), has been updated to string[] to make it easier to call these methods (#776)

[server] "tpm" attestation verification is now more tolerant of variable casing in the TPM manufacturer IDs (#772)

[server] generateRegistrationOptions() and verifyRegistrationResponse() now use the same default list of allowed public key algorithms for supportedAlgorithmIDs (#791)

[server] The validateCertificatePath() helper now supports x5c arrays containing cross-signed certificates (#796)

Breaking Changes

[browser] [server] The minimum supported runtime versions have been increased to Node LTS 22.x and higher, and Deno v2.4.x and higher (#763)

v13.3.3

Changes:

[server] Updated MDS blob signature verification to support more algorithms (#788)

[server] Updated MetadataService to know about the new FIDO MDS blob trust anchor certificate (#789)

v13.3.2

This update fixes a CVSS v4 Low (2.0) security vulnerability identified in @simplewebauthn/server. See the security advisory linked below for more information.

Changes:

[server] Fixed an issue with verifyRegistrationResponse() allowing a maliciously-crafted attestation statement's x5c to contain a self-signed "root certificate" instead of chaining back to an RP-specified trust anchor (GHSA-6hxq-p678-4hr2)

v13.3.1

Changes:

... (truncated)

Changelog

Sourced from @simplewebauthn/browser's changelog.

v14.0.0 - The one after they go quantum

The headlining feature of this release is @simplewebauthn/server gaining support for passkeys using the ML-DSA-44, ML-DSA-65, and ML-DSA-87 PQC algorithms in supported runtimes. And in those same supported runtimes, SimpleWebAuthn will automatically encourage registration of ML-DSA-44 passkeys to future-proof Relying Parties as PQC-capable FIDO2 authenticators and credential managers start coming to market. See https://simplewebauthn.dev/docs/advanced/server/pqc-ml-dsa-support for more info 🚀

Setting our sites on the browser, @simplewebauthn/browser picks up a new sendSignal() method as a single method to call all of the WebAuthn Signal APIs. See https://simplewebauthn.dev/docs/packages/browser#sendsignal for more info 🛜

As for breaking changes, the minimum supported version of Node has been raised to Node LTS 22.x and higher, and Deno v2.4.x and higher. Going forward, SimpleWebAuthn will more formally aim to support Node LTS releases through their Active and Maintenance windows as tracked on the Node.js Releases page, and aim to support Deno minor releases for up to one year after their release

That's not all, though. Continue reading for the full list of changes in this release! 🎉

Changes:

[server] The PQC ML-DSA-44, ML-DSA-65, and ML-DSA-87 signature algorithms are now supported as passkey public key algorithms when the runtime supports them. In runtimes that support these PQC algorithms, generateRegistrationOptions() will include ML-DSA-44 as the most preferred public key algorithm during registration. See https://simplewebauthn.dev/docs/advanced/server/pqc-ml-dsa-support for more info (#785, #794)

[browser] The new sendSignal() method offers a simple way to invoke the WebAuthn Signal APIs. See https://simplewebauthn.dev/docs/packages/browser#sendsignal for more info (#778)

[browser] The new browserSupportsPasskeys() helper method performs more robust WebAuthn support detection by also checking for typical passkey-related WebAuthn features. See https://simplewebauthn.dev/docs/packages/browser#browsersupportspasskeys for more info (#761)

[browser] The new getBrowserCapabilities() helper method wraps WebAuthn's getClientCapabilities() with additional feature detection checks when possible. See https://simplewebauthn.dev/docs/packages/browser#getbrowsercapabilities for more info (#761)

[server] verifyAuthenticationResponse() accepts an optional new expectedTopOrigin argument that supports cross-origin authentication verification. See https://simplewebauthn.dev/docs/advanced/server/cross-origin-support for more info (#773)

[server] MetadataService.initialize() accepts an optional new logger argument that can be used to capture MetadataService status output in a project-specific manner. See https://simplewebauthn.dev/docs/advanced/server/metadata-service#logging for more info

... (truncated)

Commits

3e2dc0c Update version to v14.0.0
618c0e9 Merge v14.0.0 milestone to master (#792)
See full diff in compare view

Updates @simplewebauthn/server from 13.3.3 to 14.0.3

Release notes

Sourced from @simplewebauthn/server's releases.

v14.0.3

Changes:

[server] PQC support is now lazily evaluated. This delays Node from emitting its PQC warnings from when the Node process starts to when a method is called that checks for PQC support (#809)

v14.0.2

This update fixes a CVSS v3 Moderate (5.4) security vulnerability identified in @simplewebauthn/server. See the security advisory linked below for more information.

Changes:

[server] Revamped certificate revocation logic to only cryptographically verify and process CRLs from certificates that chained back to an RP-chosen trust anchor (GHSA-2g3p-m8c9-hhwh)

v14.0.1

[server] Attestation statements using PQC algorithms can now be verified (#800)

v14.0.0 - The one after they go quantum

The headlining feature of this release is @simplewebauthn/server gaining support for passkeys using the ML-DSA-44, ML-DSA-65, and ML-DSA-87 PQC algorithms in supported runtimes. And in those same supported runtimes, SimpleWebAuthn will automatically encourage registration of ML-DSA-44 passkeys to future-proof Relying Parties as PQC-capable FIDO2 authenticators and credential managers start coming to market. See https://simplewebauthn.dev/docs/advanced/server/pqc-ml-dsa-support for more info 🚀

Setting our sites on the browser, @simplewebauthn/browser picks up a new sendSignal() method as a single method to call all of the WebAuthn Signal APIs. See https://simplewebauthn.dev/docs/packages/browser#sendsignal for more info 🛜

As for breaking changes, the minimum supported version of Node has been raised to Node LTS 22.x and higher, and Deno v2.4.x and higher. Going forward, SimpleWebAuthn will more formally aim to support Node LTS releases through their Active and Maintenance windows as tracked on the Node.js Releases page, and aim to support Deno minor releases for up to one year after their release

That's not all, though. Continue reading for the full list of changes in this release! 🎉

Changes:

[server] The PQC ML-DSA-44, ML-DSA-65, and ML-DSA-87 signature algorithms are now supported as passkey public key algorithms when the runtime supports them. In runtimes that support these PQC algorithms, generateRegistrationOptions() will include ML-DSA-44 as the most preferred public key algorithm during registration. See https://simplewebauthn.dev/docs/advanced/server/pqc-ml-dsa-support for more info (#785, #794)

[browser] The new sendSignal() method offers a simple way to invoke the WebAuthn Signal APIs. See https://simplewebauthn.dev/docs/packages/browser#sendsignal for more info (#778)

[browser] The new browserSupportsPasskeys() helper method performs more robust WebAuthn support detection by also checking for typical passkey-related WebAuthn features. See https://simplewebauthn.dev/docs/packages/browser#browsersupportspasskeys for more info (#761)

[browser] The new getBrowserCapabilities() helper method wraps WebAuthn's getClientCapabilities() with additional feature detection checks when possible. See https://simplewebauthn.dev/docs/packages/browser#getbrowsercapabilities for more info (#761)

[server] verifyAuthenticationResponse() accepts an optional new expectedTopOrigin argument that supports cross-origin authentication verification. See https://simplewebauthn.dev/docs/advanced/server/cross-origin-support for more info (#773, h/t @agektmr)

[server] MetadataService.initialize() accepts an optional new logger argument that can be used to capture MetadataService status output in a project-specific manner. See https://simplewebauthn.dev/docs/advanced/server/metadata-service#logging for more info (#765)

[server] The typing of transports in excludeCredentials when calling generateRegistrationOptions(), and allowCredentials when calling generateAuthenticationOptions(), has been updated to string[] to make it easier to call these methods (#776)

[server] "tpm" attestation verification is now more tolerant of variable casing in the TPM manufacturer IDs (#772)

[server] generateRegistrationOptions() and verifyRegistrationResponse() now use the same default list of allowed public key algorithms for supportedAlgorithmIDs (#791)

[server] The validateCertificatePath() helper now supports x5c arrays containing cross-signed certificates (#796)

Breaking Changes

[browser] [server] The minimum supported runtime versions have been increased to Node LTS 22.x and higher, and Deno v2.4.x and higher (#763)

Changelog

Sourced from @simplewebauthn/server's changelog.

v14.0.3

Changes:

[server] PQC support is now lazily evaluated. This delays Node from emitting its PQC warnings from when the Node process starts to when a method is called that checks for PQC support (#809)

v14.0.2

This update fixes a CVSS v3 Moderate (5.4 / 10) and a CVSS v3 Moderate (6.3 / 10) security vulnerabilities identified in @simplewebauthn/server. See the security advisory linked below for more information.

Changes:

[server] Revamped certificate revocation logic to only cryptographically verify and process CRLs from certificates that chained back to an RP-chosen trust anchor (GHSA-2g3p-m8c9-hhwh, GHSA-j3h4-m3m2-7p7j)

v14.0.1

Changes:

[server] Attestation statements using PQC algorithms can now be verified (#800)

v14.0.0 - The one after they go quantum

The headlining feature of this release is @simplewebauthn/server gaining support for passkeys using the ML-DSA-44, ML-DSA-65, and ML-DSA-87 PQC algorithms in supported runtimes. And in those same supported runtimes, SimpleWebAuthn will automatically encourage registration of ML-DSA-44 passkeys to future-proof Relying Parties as PQC-capable FIDO2 authenticators and credential managers start coming to market. See https://simplewebauthn.dev/docs/advanced/server/pqc-ml-dsa-support for more info 🚀

Setting our sites on the browser, @simplewebauthn/browser picks up a new sendSignal() method as a single method to call all of the WebAuthn Signal APIs. See https://simplewebauthn.dev/docs/packages/browser#sendsignal for more info 🛜

As for breaking changes, the minimum supported version of Node has been raised to Node LTS 22.x and higher, and Deno v2.4.x and higher. Going forward, SimpleWebAuthn will more formally aim to support Node LTS releases through their Active and Maintenance windows as tracked on the Node.js Releases page, and aim to support Deno minor releases for up to one year after their release

That's not all, though. Continue reading for the full list of changes in this release! 🎉

... (truncated)

Commits

084e601 Update server version to v14.0.3
cd402cc Lazily evaluate PQC support to prevent Node warnings on startup (#809)
7e3c4c4 Kinda makes more sense to do the AKI check first
21f99a2 Update server version to v14.0.2
f03758a Merge commit from fork
0bfdc3b Update server version to v14.0.1
4831ce2 Fix X.509 parsing to support PQC use in attestation statements (#800)
3e2dc0c Update version to v14.0.0
618c0e9 Merge v14.0.0 milestone to master (#792)
See full diff in compare view

Updates @xterm/xterm from 5.5.0 to 6.0.0

Release notes

Sourced from @xterm/xterm's releases.

6.0.0

Features

#5453 Add synchronized output support (DEC mode 2026)

#5436 add range to IHTMLSerializeOptions

#5334 Support shadow dom in webgl renderer

#5285 Support detailed ligatures and variants

#5251 progress-addon

#5234 Add reflowCursorLine option

#5224 putty-style ED2 sequence handling as terminal option

#5107 Add top/bottom border overview ruler options

⚠️ This is a breaking change, ITerminalOptions.overviewRulerWidth is now a property of ITerminalOptions.overviewRuler

#5096 Integrate base/ platform from VS Code and adopt scroll bar

⚠️ This is a potential breaking change, the viewport/scroll bar works very differently now

#5092 Add support for ESM via esbuild

#5034 Expose onWriteParsed on API

#4220 Add support to ANSI OSC52

Fixes

#5445 Prefer performance.now() over Date.now()

#5437 Prevent entire page from scrolling when scrolling in alt buffer with mouse event off

#5423 Clear selection on vertical resize

#5411 Fix teleport when exiting out of alt buffer. v2

#5391 Bring back partial wheel tracking

#5390 Fix scrollbar teleport after exiting alt buffer

#5386 fix: ensure that currentRow can not go out of the range

#5385 Fix terminal find when wrapped

#5355 Add note about reverse tabnapping

#5346 Remove alt -> ctrl+arrow hack in favor of embedder-specific solutions

⚠️ This is a breaking change, you will need to add keybindings in your code if you want alt to map to ctrl still

#5337 Fix finding terms across wrapped lines

#5335 webgl: Ignore alpha channel when allowTransparency is false

#5328 Refresh viewport after clear or ED

#5305 Fix issue where listeners remain after WebglRenderer throws

#5291 Make ProgressAddon.onChange non undefined

#5282 Fixed CapsLock triggering input twice in MacOS.

#5279 Fixes: #5270 regex case-sensitive should behave like monaco

#5278 Handle glyph widths up to the maximum device texture size

#5277 Disable ligatures when cursor is in range

#5276 Fix selection rendering on ligatures in both renderers

#5265 Revert to cursor options after DECSCUSR 0

#5263 Make textarea readonly when disableStdin is set

#5262 Blend cursorAccent with background too

#5260 Blend cursor with background to support alpha in webgl

#5253 bug: properly render the terminal when open() is called again

#5249 Fix click event bug caused by DomRenderer replaceChildren behavior

#5209 Ensure last ligature cell is updated

#5208 Set liga font feature when ligatures is enabled

#5182 fix #5181

... (truncated)

Commits

f447274 Merge pull request #5463 from Tyriar/tyriar/v6
f68d1e5 Skip sync output tests for now
30691e8 v6.0.0, bump addon versions, publish unicode graphemes
5fa6325 Merge pull request #5462 from Tyriar/tyriar/deprecated
3571d1f Remove windowsMode in favor of windowsPty
ebc0d83 Remove deprecated/unused fastScrollModifier
d1c50c1 Merge pull request #5461 from Tyriar/tyriar/glob
92b43bd Remove only
a9d3ca1 Merge pull request #5449 from iSuslov/exports/esm-headless-node
cb4d1ef Merge pull request #5453 from chrislloyd/feat/synchronized-output
Additional commits viewable in compare view

Updates boxen from 8.0.1 to 9.0.0

Release notes

Sourced from boxen's releases.

v9.0.0

Breaking

Require Node.js 22 0aead27

Improvements

Add maxWidth option 5932ef4

Add footer option e719cec

Add titleColor option c0f18e7

Add borderBackgroundColor option (#100) 1373d4f

Lots of bug fixes

sindresorhus/boxen@v8.0.1...v9.0.0

Commits

a809729 9.0.0
2e901c1 Measure a label with the corners it is drawn between
6d377fb More tests
427ac21 Give the box the height it is given when the text does not fit
94db7a5 Write a border character the way a label is written
804e1e7 Keep a styling escape whole when a backspace is applied
9f8fabd Draw a padding and a margin as a whole number of columns
986a49b Do not take columns for a margin that is not drawn
2bc26cd Measure the border in columns
7ed8da2 Read the height of the terminal from LINES
Additional commits viewable in compare view

Updates chalk from 5.6.2 to 6.0.1

Release notes

Sourced from chalk's releases.

v6.0.1

Fix inconsistent coercion of two arguments 9c93a04

chalk/chalk@v6.0.0...v6.0.1

v6.0.0

Breaking

Require Node.js 22 8a94e0e

Improvements

Add underline styles and underline colors (#689) 4c304dd

Improve performance 5729845 fa5cff2

Fixes

Treat a numeric FORCE_COLOR as an exact level (#688) e912931

Downsample ansi256() and bgAnsi256() to 16 colors at level 1 (#687) ff549c5

chalk/chalk@v5.6.2...v6.0.0

Commits

47fc05a 6.0.1
9c93a04 Fix inconsistent coercion of two arguments
8960ada Meta tweaks
661317e 6.0.0
5729845 Improve performance
4c304dd Add extended underline styles and underline colors (#689)
e912931 Fix: Treat a numeric FORCE_COLOR as an exact level (#688)
8a94e0e Require Node.js 22
fa5cff2 Optimize 2-argument calls (#670)
ff549c5 Fix: Downsample ansi256() and bgAnsi256() to 16 colors at level 1 (#687)
Additional commits viewable in compare view

Updates connect-redis from 9.0.0 to 10.0.0

Release notes

Sourced from connect-redis's releases.

v10.0.0

Breaking changes

#439 - Fix broken windows (@wavded)

Maintenance

#439 - Fix broken windows (@wavded)

#435 - Fix broken windows (@wavded)

Commits

559183d 10.0.0
51e2f01 Fix broken windows (#439)
8d733b3 Fix broken windows: (#435)
See full diff in compare view

Updates dotenv from 17.4.2 to 18.0.4

Changelog

Sourced from dotenv's changelog.

18.0.4 (2026-09-25)

Changed

import dotenv/config should default quiet: true (#1063)

18.0.3 (2026-09-22)

Changed

Patch DOTENV_QUIET setting when inside .env file (#1059)

18.0.2 (2026-09-21)

Changed

Patch additional edge cases for the fast parser (#1056)

18.0.1 (2026-09-18)

Changed

Handle file urls in config logging (#1054)

18.0.0 (2026-09-17)

Added

NEW: Dotenv now has a CLI. (#1022)
$ dotenv run -- node index.js
◇ injected env (2) from .env
Hello Dotenv
NEW: Dotenv now has a fast parser thanks to @homanp of superagent.sh. Pass config({ fast: true }), flag --fast, or set DOTENV_FAST=true to opt-in to ~2x faster character-scanner parser. (#1010)
$ dotenv run --fast -- node index.js
◇ injected env (2) from .env
Hello Dotenv
faster than Node native parseEnv!

Changed

Injecting message sent to stderr rather than stdout and tips removed (#1037)

... (truncated)

Commits

86804c0 18.0.4
2403db5 changelog
75b775e npm audit
7e1750c Merge pull request #1064 from motdotla/dependabot/npm_and_yarn/ip-address-10.7.2
a6ade63 Merge pull request #1063 from motdotla/import
288b0d7 patch test
00da912 Bump ip-address from 10.2.0 to 10.7.2
e6b5816 import 'dotenv/config' should still be defaulting to quiet
3646ac5 Merge pull request #1061 from motdotla/fast
83fc961 report dotenv vs native vs dotenv.fast
Additional commits viewable in compare view

Updates ioredis from 5.11.1 to 6.0.0

Release notes

Sourced from ioredis's releases.

v6.0.0

6.0.0 (2026-07-31)

Add RESP3 (#2127) (5d0862e)

Bug Fixes

clear stale socket timeout on reconnect (#2148) (6455dbe)

cluster: recreate stale connection on circular MOVED (#2135) (08c8967)

cluster: validate MOVED slot to prevent Array.prototype pollution (#2151) (9618206), closes #1267

command: serialize large integer arguments in decimal notation (#2136) (09b8d04)

redis: keep reconnecting when connection closes during client setup (#2099) (#2123) (f9a66bc)

sentinel: preserve zero preferred slave priority (#2129) (a3f9f2d)

tracing: redact values for GETSET and PSETEX (#2134) (832765d)

types: export ScanStreamOptions, RedisStatus and ClusterStatus (#2158) (cf3bf71)

Features

add LMOVEM and BLMOVEM command support (#2144) (c26af46)

add Redis 8.10 set cardinality commands (#2143) (301099b)

himport managed fieldsets (#2159) (729f174)

improve default connection resilience (#2160) (6d0716e)

support MAXCOUNT and MAXSIZE for stream reads (#2142) (ae5e41b)

BREAKING CHANGES

ioredis now requires Node.js 20 or newer and uses RESP3 by default. Set protocol: 2 to retain the v5 wire protocol.

v6.0.0-beta.1

6.0.0-beta.1 (2026-07-29)

Add RESP3 (#2127) (5d0862e)

Bug Fixes

clear stale socket timeout on reconnect (#2148) (6455dbe)

cluster: recreate stale connection on circular MOVED (#2135) (08c8967)

cluster: validate MOVED slot to prevent Array.prototype pollution (#2151) (9618206), closes #1267

command: serialize large integer arguments in decimal notation (#2136) (09b8d04)

redis: keep reconnecting when connection closes during client setup (#2099) (#2123) (f9a66bc)

sentinel: preserve zero preferred slave priority (#2129) (a3f9f2d)

tracing: redact values for GETSET and PSETEX (#2134) (832765d)

... (truncated)

Changelog

Sourced from ioredis's changelog.

6.0.0 (2026-07-31)

Add RESP3 (#2127) (5d0862e)

Bug Fixes

clear stale socket timeout on reconnect (#2148) (6455dbe)

cluster: recreate stale connection on circular MOVED (#2135) (08c8967)

cluster: validate MOVED slot to prevent Array.prototype pollution (#2151) (9618206Description has been truncated

JS-driven progress bars now animate transform: scaleX instead of width (no layout thrash): pl-bar loader (header/page-loader), toast progress bar, loading-popup fill, transfer progress, password-strength bar. Track overflow-hidden kept/clamped; transform-origin left center.

POST /admin/addons/store/uninstall was fetched by admin-addons.js and store.ejs but had no route (404). Matches its sibling stubs (list/discussions/install) while the addon store is coming soon.

Prior-session WIP (complete): mobile more-sheet gains a server-view submenu (sheet-swipe-left/right stagger, reduced-motion respected), template sidebar items get --i stagger animation. Repaired $1 sed artifacts in template.ejs admin nav.

…n admin links

admin user create/edit/delete flows, api-key page, sidebar nav (Dashboard/Locations), and server edit page referenced keys absent from the canonical en locale (rendered via view fallbacks).

…il shown - hide pc-sidebar on mobile via hidden class (was a tall empty block on top of the page since items became opacity:0 until .showing) - apply initial showSidebarView on load so sidebar/sheet items are visible without user interaction - openSheet shows main view when no server view exists (items stayed opacity:0 forever on non-server pages) - sheet hiding now transform-based instead of CSS translate (works on older browsers that ignore the translate property)

window 'load' never fires if an external resource (dicebear avatar, font) hangs, so js-loading was never removed and the loader overlay (pointer-events:all) stayed up forever: blank page + unclickable UI. - reveal content via 2s load guard on DOMContentLoaded (load still wins if it fires first) - loader overlay is now pointer-events:none (decorative only)

a8dc4f8 dropped the default-hidden mechanism (opacity-0 pointer-events-none) from the consolidated global modal; with no hidden state, the rgba(0,0,0,0.5) scrim and empty panel covered every page until the backdrop was tapped. Restore display:none via the hidden class (utilities layer, wins over .al-sheet-overlay flex); Animate.openModal/closeModal already toggle it.

…ak the UI iOS Safari often serves cached assets without revalidating, so the user's phone kept running the pre-guard page-loader.js — js-loading stuck, the loader overlay covering everything, content invisible until the More tap. Version all /js, /javascript, styles.css, layout-animations.css and styles/motion.css references so every page forces fresh files.

…ted inside it Since c56e337 the sheet's closing </div> was missing, so the browser parsed the modal, backdrop and the entire <main> content as children of #mobile-more-sheet. The sheet is translate-y-full (off-screen), which pushed the whole page below the viewport: only the fixed top bar and bottom nav were visible. Clicking More slid the sheet up — dragging the entire app back into view, which is why it looked like the overlay 'cleared' only then. Desktop was affected too (sheet lg:hidden made everything inside it invisible).

… animation The Back and Go Back buttons in the mobile sheet had the mobile-more-link class, which triggered closeSheet() on click — instead of switching views like the sidebar equivalents. Removed that class so they call showSheetView(). Added active:scale-95 depress on press to all four buttons (sidebar + sheet). Bumped sidebar button touch target from min-h-9 (36px) to min-h-[44px] (44px) to match.

…, active highlights) - Fixed critical missing </div> that caused sheet to swallow page content - Sheet positioned above bottom bar (bottom: 60px) with max-height constraint - Added pill drag handle at top of sheet - Extend-up animation on open, reverse on close - Sheet background matches nav theme (--theme-nav-bg) - Active state highlights on current page items using --theme-accent - More button toggles open/close - Drag-down-to-close on pill handle - Server view with Back/GoBack navigation between views

- Fix CRITICAL XSS in edit.ejs (JSON.parse with unescaped output) - Fix XSS in create.ejs (single-quote breakout in data attributes) - Fix XSS in user EJS views (onclick handlers, req.translations leaks) - Remove all type casts (as any, as Record<string, unknown>, etc.) - Extract 200+ magic values into named constants across JS files - Replace all var with const/let (35 JS files, 80+ EJS inline scripts) - Fix silent error swallowing (empty catch blocks → console.error) - Add input validation (admin-node-edit, admin-node-create, create-server) - Remove dead code (renderAllocatedPorts, unused variables) - Fix GB→MB conversion bug in Pterodactyl API (node.ram * 1024) - Fix wrong defaults in Pterodactyl API (Memory:4→512, Cpu:2→100) - Replace monkey-patching with WeakMap in daemon nativeSftp - Add named constants to all handler utils (ports, csrf, nodeStatus, etc.) - Fix catch(error: any) → catch(error: unknown) across all modules - Fix Prisma types (ServerGetPayload, UIComponentStore export) - Fix URL scheme validation in addon store (prevent javascript: URLs)

CSS & Themes: - Fix WCAG AA contrast: 13 color tokens across 7 themes - Add missing design tokens (--theme-disabled, --theme-focus-ring, --theme-radius-*, --theme-shadow-*, --theme-skeleton-*, --theme-btn-*) - Unify motion timing: replace mixed easing with cubic-bezier(0.16, 1, 0.3, 1) - Fix duplicate CSS selectors (hide-scrollbars.css) - Add disabled states to al-btn-ghost, al-input, cs-trigger, tab-btn, chips - Fix solarized-light dark mode copy-paste (html.dark prefixed selectors) - Add --ease-bounce for checkbox micro-interaction EJS Components (30 files): - Fix <a><button> invalid HTML nesting → styled <a> - Add missing alt text on images (users, settings) - Add missing aria-labels (store cards, toasts, install status) - Add keyboard support (store addon cards → <button>) - Add prefers-reduced-motion for skeleton animations - Add manual dismiss button on toasts - Add theme-color meta tag - Make store search responsive (w-full on mobile) - Add complete button state coverage (hover/active/focus/disabled) - Fix orphaned closing tags (players, file, worlds) - Add missing toast/footer includes (startup, players, credits) - Fix heading hierarchy (al-card-header → <h2>) Admin Views: - Fix duplicate type attribute, duplicate style attribute - Fix inconsistent padding (p-6 → pb-12) - Replace button-onclick navigation with <a href> User Views: - Fix broken worlds.ejs noWorldsMessage block - Move breadcrumb/search out of <table> in files.ejs - Add scope/aria-label on table headers - Add for/id on form labels (databases, startup, backups, account) JS-Driven Styles: - Replace hardcoded colors/easings with CSS custom properties (--theme-*, --ease-*) - Fix syntax error in component-persistence.js - Replace hardcoded chart colors with theme tokens

Sidebar: - Remove CSS !important overrides on active nav (let JS handle inverted colors) - Active nav now white in dark mode, black in light mode Admin/apikeys: - Fix FormData encoding (URLSearchParams instead of FormData body) - Server was receiving empty body → 'name required' error Admin/images: - Add upload modal with drag-drop zone (matching files.ejs pattern) - Replace native file picker with proper popup Admin/images/store: - Add 1.5s delay before closing install popup - Show success state (checkmark + green background) before close Activity logging: - Add logActivity calls for user:create/delete/update - Add logActivity calls for node:create/update/delete - Add logActivity calls for apikey:create/delete - Add logActivity calls for image:create/update/delete Admin/users: - Fix error responses (return JSON instead of redirect) - Add self-deletion guard - Add session cleanup on user delete Admin/locations: - Merge into admin/nodes page as bottom section - Add scroll-to anchor link in page header - Redirect /admin/locations to /admin/nodes#locations Tables: - Add table-layout: fixed to .al-table for even column distribution - Add colgroup/col width definitions to servers, nodes, users tables - Card headers already extend edge-to-edge via negative margins

…reate-server page Admin/mounts: - Rebuild page with proper al-table (Name/Source/Target/Read-only/Actions) - Colgroup width distribution, empty state, font-mono path chips - Rebuild modal with al-sheet-overlay pattern, Animate.openModal - Delete via window.modal.confirm Sidebar: - Remove Locations link from sidebar and mobile bottomNav - Locations now a tab on nodes page (Nodes/Locations tabs, hash-aware) Sidebar highlight: - Fix page-loader.js setDesktopActiveLink (identical dark/light ternaries bug) - Fix transitions.js updateNav same bug - Add inverted pill CSS (!important, #pc-sidebar specificity) - Active nav now white bg/black text in dark, black bg/white text in light Nodes/edit: - Rebuild Maintenance Mode card with proper toggle switch (sr-only peer + al-toggle) - Remove overflow:hidden CSS override clipping card headers Admin/servers/create: - Fix double-encoded JSON (JSON.stringify of stored JSON strings) - Tolerant parseJson() helper, unwraps legacy double-encoding - Fix ports showing 2 pre-selected ('[]'.length === 2 bug) → Math.max(1, requirements.length)

Server/console (manage.ejs): - Fix vendor script 404s (xterm-addon-fit, xterm-addon-web-links had wrong URLs) - Fix defer ordering bug: inline console script ran before deferred vendor scripts, Terminal was undefined - Switch xterm from CDN to self-hosted /vendor paths - Terminal now connects, install logs stream, power buttons work end-to-end Server/databases: - Root cause: <%= JSON.stringify(req.translations) %> HTML-escaped JSON into script → SyntaxError killed ALL handlers - Remake: al-card + al-table (Name/Host/Connection string/Username/Password/Actions) - data-action delegation instead of fragile onclick, in-place rotate update - Fix eye icon (didn't exist), proper Animate modal pattern, empty states Server/schedules: - Fix broken [data-schedule-id] selectors after restructure - Fix broken data-sched-name escaping - Modal footer out of scrollable area - Remake: al-table (Name/Schedule/Tasks/Enabled/Actions) + inline task management rows Server/subusers: - Fix JSON.stringify in onclick splitting HTML attribute (edit modal never opened) - Fix apostrophe escaping in remove handler - Pass canonical PERMISSION_GROUPS from serverAuthUtil (was stale 24-perm subset) - Remake: al-sheet modal pattern, permission rows with accent highlight, empty state

Root cause: panel only showed lifecycle messages; real container output was invisible because logs weren't being captured by the daemon without an open console WS (now fixed daemon-side). Panel now fetches and displays them. Changes in manage.ejs: - Extract loadRecentLogs(showMarkers): reusable helper from loadLogHistory - On lifecycle 'started': auto-load real logs from disk history, then force-reconnect console socket if it wasn't open - On lifecycle 'stopped'/'killed': fetch ring buffer to show final output - On lifecycle 'installing': auto-load install logs once per session - Server-stopped flag: prevent reconnect hammering while container stopped - Force-reconnect helper: reset backoff + immediate reconnect on start - Placeholder: showConsolePlaceholder now writes 'waiting for output' message - New flags: serverStopped, logsAutoLoaded, installLogsLoaded (dedup + gating)

…ed output Server delete (servers.ts): - Delete activityLog rows for the server inside the delete transaction - Log server:delete with serverId:null + UUID in metadata (was passing server.UUID after the row was deleted → foreign key constraint violation on every delete, '[audit] failed to write activity log' error) Console (manage.ejs): - Fix writeConsole('info', ...) 2-arg call → '[info] undefined' spam (placeholder message now correct: writeConsole('daemon', 'info', ...)) - Guard crashReasonLabel null: writeConsole/showToast only when reason exists (was printing '[daemon] null' + null toast on unexpected stop)

Security (panel): - SSRF protection: fetchPublic() for image import, assertSafePublicUrl for file pull - Path validation: isPathSafe on writeFile/deleteFile/renameFile - Password reset: invalidate all tokens on password change - Sibling token invalidation on reset completion - DaemonService: enforceDaemonHttps protocol resolution - Remove duplicate 2FA check (dead code) Security (daemon): - BEHIND_PROXY: TRUSTED_PROXY_IPS alignment with server.ts - SFTP TOCTOU: secureOpenRead/Write/Append/ReadWrite via openat2 - REQUIRE_HMAC: read config.requireHmac not Bun.env - copyIntoVolume: skip symlinks - listDir cache: return limited array not full - secureUnlink: document remaining TOCTOU window - downloadTokens: truncate token in logs - sftpServer: unref cleanup interval - ws/server.ts: WebSocket count drift fix CI (panel): - Path filters: skip CI on doc-only changes - dorny/paths-filter: conditional job execution - Dependency caching with pnpm store - Proper postinstall: prisma generate for typecheck/test/build - ci-gate job for branch protection - --frozen-lockfile everywhere CI (daemon): - Path filters: skip on doc-only changes - Bun dependency cache - --frozen-lockfile - Embedded check job - Build verification job - ci-gate job for branch protection - Fix lockfile ref (bun.lock not bun.lockb) Build (daemon): - Preflight job: validate version, run checks before building - SHA-256 checksums in release - Bun dependency cache Version bump (daemon): - Manual dispatch only (was auto-bumping on every push) - Version format validation - Optional sync toggles for README/example.env - Skip empty commits Docs: - Fix README curl command, update version refs - Fix example.env VERSION drift - Fix release-specification bun version

pnpm/action-setup@v4 + setup-node cache:pnpm race condition. Node.js 24 -> 22 (stable). Explicit pnpm version: 11.

… packageManager

- Add GRANT CREATE ON SCHEMA public (PG15+ removed from GRANT ALL) - Add GRANT ALL ON ALL TABLES/SEQUENCES for existing objects - Detect pnpm or fall back to npm/npx throughout setup

Lockfile was gitignored causing --frozen-lockfile to fail in CI. Removed pnpm-lock.yaml from .gitignore.

… --skip-generate

- Rewrite migration.sql: MySQL backticks → PG double quotes, DATETIME→TIMESTAMPTZ - cspHeaders.test.ts: defer readFileSync into beforeAll to prevent ENOENT at describe time - filesBackend.test.ts: mock Redis to prevent rate limiter hanging in CI

…and test fixes (#124) * chore:checkpoint commit too many changes rn * chore:checkpoint commit 2 * feat: config system, i18n, CSS extraction, views restructure, source cleanup - Config system: src/config/ with context-specific modules (timeouts, limits, auth, server, daemonTimeouts, urls, mime, ui) + barrel defaults.ts + backwards-compat constants.ts - i18n service: src/services/i18n.ts with t(), tn(), logT(), req.translations Proxy, i18nMiddleware - English lang.json: deduplicated 59 duplicate keys, 2096 canonical keys - EJS templates: hardcoded strings replaced with i18n calls (admin, user, server views) - CSS: extracted ~40 hardcoded values to :root custom properties (tw.css, layout-animations.css, motion.css) - Views: renamed camelCase to kebab-case, moved admin/mounts/index.ejs → mounts.ejs, extracted settings script - Source: barrel index.ts files, merged platform/daemon/dtos, Alternative → legacy - Fix: CSP upgradeInsecureRequests only when HTTPS, doubled import prefixes, as const assertion - Fix: i18n logger import path, middleware types, LANG_DIR path - Fix: playerStatsCollector/daemonRequest/wsToken config import names - DB: prisma db push synced schema to PostgreSQL * fix: seed default roles on startup, conditional CSP upgradeInsecureRequests - Seed owner/admin/user roles when Role table is empty (fixes fresh DB registration FK violation) - Only enable upgradeInsecureRequests CSP directive when running HTTPS (fixes blank page on remote access via HTTP) * feat: expand env config, Dockerfile, Playwright, remove onboarding, codebase cleanup - Expand .env with 20+ configurable fields (TLS, SMTP, rate limits, CSP, proxy, cookies, storage, logging) - Add parsePositiveInt/parseBytes to config.ts for env parsing - Wire all new env options into app.ts (TLS HTTPS, trust proxy, session, rate limiting) - Update templateConfig.ts to expose all panel config fields to EJS - Fix envLoader.ts comment-line parsing in example.env scanner - Bundle @tanstack/query-core as IIFE vendor script - Create Dockerfile (node:22-bookworm test image) + .dockerignore - Create playwright.config.ts with chromium webServer setup - Update setup.mjs with 11 new CLI flags for all env options - Update installer.sh with 7 new args, TUI prompts, full .env generation - Fix CSP test (cspEnabled check + unsafe-eval) - Fix migration-invariants test (query-core path) - Fix responsiveA11y test (aria-label partial match) - Remove onboarding system (schema, routes, views, JS, i18n keys) - Remove old admin-settings JS bundles (replaced by new builds) - Clean up Prisma generated types and API modules - Remove stale dashboard/settings/ejs views * refactor: clean up package.json, move Docker test infra to tests/docker/, merge e2e into ci.yml - package.json: add keywords, homepage, bugs, description; add db:* scripts (generate, push, migrate, seed, reset, drop, studio, status); add test:e2e, test:docker, test:all; remove dead installer/build-vendor refs - Move Dockerfile + entrypoint.sh + docker-compose.test.yml → tests/docker/ - Add e2e Playwright job to ci.yml (depends on build, uploads report artifact) - Add top-level env vars (NODE_VERSION, PNPM_VERSION) to ci.yml for DRY - Fix migrate:deploy → db:migrate:deploy in ci.yml - Delete redundant test.yml workflow * fix(ci): remove pnpm version conflict — let action read from packageManager * fix: resolve all CI failures — lint, tests, build job - Fix eslint: singlequotes in app.ts, curly braces in config.ts (eslint --fix) - Fix CI build job: db:migrate:deploy → db:push (no migration files exist) - Fix cspHeaders test: match escaped unsafe-eval string - Fix featureRegistry test: api/alternative → api/legacy (renamed module) - Skip apiAlternativeValidator + daemonDtos tests (modules deleted in cleanup) - Fix activityLogger + adminUsersHtmx tests: add res.locals.t/tn mock, update assertions for i18n keys * fix(tests): mock realtime/events in adminNodesServers to prevent Redis cascade Missing mock caused emitRealtime to hit real Redis → Connection closed → timeouts in adminUsersHtmx and backupsBackend via parallel runner. * fix(ci): add Redis service + .env to UT job, mock realtime/events in 4 tests CI Unit Tests had no Redis service and no .env file — tests that import modules using emitRealtime (shared, backups, schedules, files) hit real Redis, got MaxRetriesPerRequestError, cascading timeouts. - Add Redis 7 service container to CI test job - Write full .env mirroring setup.mjs output (session, redis, db, smtp) - Mock realtime/events in resourceRelease, filesBackend, schedulesBackend, adminNodesServers to prevent real Redis connections in unit tests * fix: remove type:module (breaks CJS build output), drop E2E from CI gate - Replace "type": "module" with "main": "dist/app.js" — tsconfig outputs CommonJS, module:module makes Node treat .js as ESM → crash - Remove E2E from ci-gate needs/results — no Playwright test files exist yet, so E2E always fails and blocks the pipeline * chore :add generated dir * fix: use SUPPORTED_LANGUAGES constant in account.ejs language selector - Template referenced undefined 'supportedLanguages' variable - Matches res.locals.SUPPORTED_LANGUAGES set by templateConfig.ts - Fixes ReferenceError crash on /account page

Vite build pipeline: - Add vite.config.mjs (reads public/styles/tw.css, outputs hashed assets) - Add assetUrl() helper with Vite manifest resolution - Update 24 EJS templates: assetPath() → assetUrl() - Wrap 4 bare hardcoded paths in assetUrl() - Add db-reset.mjs with warning UIs Prisma Json-as-String migration (report #5): - Convert 13 String fields to native Json type in schema.prisma (permissions, Ports, Variables, allocatedPorts, bannedIps, dockerImages, variables, scripts, config_files, portRequirements, payload, SubUser.permissions, ApiKey.permissions) - Remove JSON.parse/JSON.stringify in 35+ TS files - Add type casts for Prisma JsonValue compatibility Baseline migration (report #8): - Remove broken 20260829_add_passkey_model migration - Create 20260910_baseline with full schema DDL - Database re-provisioned cleanly Other fixes from report: - SQL injection guard in addonHandler (report #1) - DatabaseHost password encryption AES-256-GCM (report #2) - req.panelUser auth middleware (report #4) - ESLint no-explicit-any: error (report #7) - Dev script uses prisma migrate dev (report #11) - Installer copyright fix (report #12)

- Create scripts/executer.mjs — single entry point for all package.json commands (start, build, test, db:*, lint, format, typecheck, etc.) - Move scripts/ out of public/ to prevent CDN/asset exposure - CSP: allow cdn.jsdelivr.net in dev-only for Eruda console - Add Eruda debugger to both header.ejs and auth-header.ejs (dev mode only: NODE_ENV !== production) - package.json: route all scripts through executer.mjs - Remove old Express /scripts block (no longer needed)

- Remove defer from query-core.js — state.js (footer, no defer) was executing before query-core set window.ALQuery - Add 98 missing log.* translation keys to en/lang.json - Switch CSS minification from lightningcss to esbuild — eliminates 59 'Unknown at rule' warnings for Tailwind v4 @theme/@plugin/@tailwind - Simplify addonHandler build logging (no more warnings to condense)

…p lock race - New ui.mjs: shared B&W TUI primitives (Logger, box, prompt, secret, confirm, menu, spinner, sudo) - New pg-super.mjs: shared postgres superuser helper (detectMethod, runAsSuper, dropRoleCleanly) - New db-cleanup.mjs: drop DB + role permanently (no recreate) - executer.mjs: drop chalk/boxen, use ui.mjs, fix node_modules/.bin PATH, add descriptions - db-backup.mjs: unlock .backups/ dir before writing (chmod 000 race fix), simplified lockDir - db-reset.mjs: rewrite using ui.mjs + pg-super.mjs - setup.mjs: rewrite using ui.mjs, unified theme - installer.sh: copyright/header cleanup - package.json: add db:cleanup script

…help command

Phase 01-09: Turbo Drive migration + lifecycle cleanup + API consolidation BREAKING: Buttons may be broken - api-client.js script tag was missing, now added Changes: - Phase 01: Introduce Turbo Drive (@hotwired/turbo v8.0.23), account.ejs turbo-frame - Phase 02: Persistent shell (data-turbo-permanent), sidebar re-mark, online-check WS removed - Phase 03: Replace Alnav with Turbo, 19 Alnav.load() -> Turbo.visit(), 15 Alnav.reload() -> Turbo.visit(window.location.href), navigator.js deleted - Phase 04: Alpine/HTMX lifecycle cleanup, removed Alpine internals manipulation - Phase 05: API/UI contract consolidation, deleted api.js (window.api), canonical window.Api in api-client.js - Phase 06: Endpoint route cleanup, fixed nodes.ts duplicate router.get(/:id/configure) -> router.post(/:id/maintenance), removed 125 dead Api.* methods (929 -> 153 lines) - Phase 07: Realtime/islands lifecycle, added turbo:before-render + pagehide teardown for server console and file editor - Phase 08: UI system audit, removed dead .al-card-header CSS, fixed page-header gap inconsistency - Phase 09: Final hardening, removed motion.js (0 callers), cleaned dead exports from layout-animations.js, renamed al_nav -> __asm_nav, removed data-alnav-skip attributes Files changed: - Deleted: public/javascript/shared/navigator.js (793 lines, Alnav) - Deleted: public/javascript/shared/api.js (33 lines, redundant API client) - Deleted: public/javascript/shared/motion.js (195 lines, unused IntersectionObserver animations) - Modified: public/javascript/api-client.js (929 -> 153 lines, removed 125 dead methods) - Modified: public/javascript/shared/page-loader.js (renamed al_nav flag) - Modified: public/javascript/shared/layout-animations.js (removed dead exports) - Modified: public/styles/tw.css (removed duplicate .al-card-header, dead motion token) - Modified: src/modules/api/v2/admin/nodes.ts (fixed duplicate route bug) - Modified: views/components/header.ejs (Turbo enabled, api-client.js loaded, Alnav removed) - Modified: views/components/sidebar.ejs (data-turbo-permanent, online-check removed) - Modified: views/components/toast.ejs (data-turbo-permanent) - Modified: views/components/bottom-nav.ejs (removed data-alnav-skip) - Modified: views/components/footer.ejs (removed motion.js script) - Modified: views/components/ui/page-header.ejs (gap-3 -> gap-4) - Modified: views/user/account.ejs (turbo-frame) - Modified: views/user/server/manage.ejs (Turbo lifecycle teardown) - Modified: views/user/server/file.ejs (Turbo lifecycle teardown) - Modified: 20+ view files (Alnav.load -> Turbo.visit, Alnav.reload -> Turbo.visit) - Modified: scripts/admin-settings.js (window.api() -> Api.admin.settings.*) - Modified: tests/pageLoader.test.ts (removed navigator.js dependency) Note: 4 pre-existing test failures remain (activityLogger, cspHeaders, daemonContract, inputValidation) - unrelated to these changes

dependabot · 2026-09-27T22:39:43Z

Labels

The following labels could not be found: npm. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

coderabbitai · 2026-09-27T22:40:03Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: b72f8009-da63-4d06-9122-91acbc5cccdc

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

…d contains many artifacts and in progress ui and backend not for prod (#137) * fix: rip out frontend frameworks, fix all broken UI interactivity - Remove Turbo, htmx, Alpine.js, Animate, and hand-rolled mini-framework - Delete 22 JS files (al-state, al-action, al-table, al-dialog, islands, data-layer, eventrouting, operations, page-loader, auto-save, htmx-bootstrap, alpine-bootstrap, state, toast-store, query-core, loading-popup, etc.) - Delete layout-animations.css, motion.css, and @Keyframes from tw.css - Remove all x-data, x-show, hx-get, hx-post, data-turbo attributes from all views - Replace Turbo.visit() with window.location.href, htmx.ajax() with fetch - Replace turbo:load listeners with DOMContentLoaded - Fix global modal system (hidden class never toggled on open/close) - Fix tab system (event name mismatch: al:tab-change → al:tabs-change) - Re-add CSRF meta tag to header.ejs (was deleted, breaking all AJAX) - Fix all data-mutation operations to use page reload instead of dynamic DOM updates (20+ locations across 11 files) - Fix d.folder → d.data API response parsing in dashboard - Fix d.error → d.error?.message across 14 files - Fix broken include paths in api/documentation.ejs and admin/databases/databases.ejs - Remove loading-popup includes from 13 files - Fix admin settings script path (/scripts/ → /javascript/admin/) - Remove all al.removeRow, al.patchEl, window.al dead code references - Add al-tabs.js for vanilla tab switching - Fix custom-select.js dead al:navigated listeners - Fix toast.ejs remainingMs self-referencing function * fix: resolve all 6 critical UI bugs from incomplete framework removal Bug #1 — showLoadingPopup was called in 9 files but deleted without updating call sites. Every Save/Create/Update/Delete button threw ReferenceError before the fetch() ever ran. Replaced all showLoadingPopup/updateProgress/hideLoadingPopup calls with the existing showProgressToast() system (27 replacements across addons, servers, nodes, users, account, files, settings). Bug #2 — req.translations (server-only Express object) was used raw in client <script> blocks across 49 files. Every toast dismiss button and most showToast() calls threw ReferenceError at runtime. Added global window.__i18n = <%- JSON.stringify(req.translations || {}) %> in header.ejs before modal/toast includes, then mechanically replaced all 863 req.translations references in client scripts with window.__i18n. Bug #3 — data-tab-src on Images Store tab was dead weight from deleted page-loader.js. Store tab rendered permanently empty. SSR'd store-panel.ejs content inline via <%- include('store-panel') %>. Bug #4 — Removed leftover CSS transition on html/body in header.ejs and auth-header.ejs (background-color 0.25s ease-in, color 0.25s ease-in). Bug #5 — Audited views/fragments/**/*. All req.translations usage is inside <% %> EJS scriptlets (server-rendered), not client scripts. No fixes needed. Bug #6 — Audited all function calls in client <script> blocks for undefined globals. Only showLoadingPopup/hideLoadingPopup were genuinely undefined (already fixed in Bug #1). All other cross-file function calls have definitions in files loaded on the same page. * fix: credits, settings, analytics, store tab, and remaining broken UI - credits.ejs: fixed variable names (camelCase → UPPERCASE to match res.locals) - admin-settings.js: replaced al.addRow/al.removeRow with DOM manipulation - analytics.ejs: added defer to chart.js and admin-analytics.js script tags (was executing before api-client.js defer script loaded → ReferenceError) - images.ejs: added inline store-panel script for #store tab (was empty HTML with no JS — store functions only existed in store.ejs, never loaded) - store.ejs: fixed event name al:tabs-loaded → al:tabs-change (matching what al-tabs.js actually fires) - header.ejs: added missing escape.js script (defines window.escHtml used by search.js and store scripts) - schedules.ejs: replaced al.addRow with DOM append - backups.ejs: replaced al.hideEmpty with comment (dead reference) * fix: more camelCase→UPPERCASE EJS variable mismatches - portsAllocator.ejs: defaultGamePort → DEFAULT_GAME_PORT (caused server create/edit pages to crash) - create-server.ejs: defaultMaxStorageMb → DEFAULT_MAX_STORAGE_MB - credits.ejs: githubAvatarUrl() → GITHUB_AVATAR_URL() - files.ejs: fileUploadTimeoutMs → FILE_UPLOAD_TIMEOUT_MS - players.ejs: crafatarAvatarBase → CRAFATAR_AVATAR_BASE, playerListRefreshMs → PLAYER_LIST_REFRESH_MS * fix: window.__i18n crash, broken delete buttons, settings save, locations 404 ROOT CAUSE: EJS templates use `window.__i18n.X` inside <%%= %> tags (server-side), but `window` doesn't exist in Node.js. Every page crash. - i18n.ts: expose `window.__i18n` in EJS context via res.locals (maps to req.translations proxy so all existing templates work) - admin-settings.js: add null guards for banIpBtn, bannedIpBtn, smtpTestBtn, s3TestBtn — missing element crashed entire init(), killing all auto-save listeners - location-list.ejs: edit link pointed to non-existent /admin/locations/:id/edit (route doesn't exist). Changed to /admin/nodes?location=:id. Delete form used _method=DELETE (no method-override middleware). Converted to fetch() with proper DELETE method. - node-table.ejs: same _method=DELETE fix, converted to fetch() - user-list.ejs: same _method=DELETE fix, converted to call deleteUser() (which already existed in users.ejs using proper fetch) * chore: some i18n fixea * v2.6.0 — rewrite foundation: API-first UI, Lingui i18n, Vite CSS pipeline Replace the broken old UI layer with a clean foundation for the page-by-page rewrite. What changed: - Internal API client (src/handlers/internalApiClient.ts) for page controllers to call v2 endpoints in-process, forwarding session cookies and CSRF tokens. Includes CI lint rule that blocks Prisma or daemon imports in page controllers. - New EJS view structure: layouts (base/admin/user/auth), partials (flash, csrf, pagination, sidebar, UI primitives), auth pages (login/register/2fa/reset), error pages (403/404/500). All forms include CSRF tokens. No HTMX or Alpine dependencies. - CSS split from one 1268-line tw.css into 33 fragment files under views/styles/ (tokens, base, components, pages). All design tokens preserved with exact values. Vite builds to hashed output in public/assets/css/. - Lingui i18n replaces hand-rolled translation system. 10 locales migrated, 2214 English messages. Locale middleware detects from cookie/Accept-Language, injects t() helper for EJS. 43 i18n tests. - Browser JS rebuilt as ES modules under views/javascript/. Shared utilities (theme-init, csrf, api-client) and islands (xterm server console, Monaco file editor) follow mount/init pattern with dynamic imports for heavy deps. - Storage reorganized: themes split into builtin/ and user/, uploads given proper subdirectories, runtime/ reserved. Source media removed from public/. - Old UI archived to /home/thavanish/archive/airlink-panel-rewrite/ (outside repo). Old views/, public/javascript/, public/styles/ removed. - 23 page controller skeletons registered under src/modules/pages/ covering all routes. Ready to fill in during page rewrite. * chore:update desc * Phase 3 complete: page-by-page rewrite + Phase 4 fragment folding - All 12 batches complete: 60 EJS views, 23 page controllers, 33 CSS files, JS islands - Phase 2: deleted legacy API (api/legacy/api.ts), removed pterodactyl references - Phase 4: verified 19/19 archived fragments accounted for, added location-nodes drill-down + 2FA recovery codes - Fixed import paths and permission strings in user/server/index.ts - Zero Prisma/daemon imports in page controllers, all routes call v2 API * chore :add some missing stuff * fix(ui): wire SSR panel end-to-end, harden CSRF, fix overlays - declare cascade layer order (@layer) — sheets/modals stuck open because components beat utilities (.hidden) - rewrite views onto base layout; add file-detail view; fold csrf token into every session POST fetch (no unguarded sends left) - add page routes: startup command/docker-image/variables sub-forms, player actions, files+logs download redirects, create-server nodes/images/limit hints from prisma - align v2 startup DTOs (startCommand|command, verbatim Variables); seed full ServerVariable fixture with allowStartupEdit - drop dead security sub-routes, rename routes onto page controllers - verify: vitest 1058, tsc 0, eslint 0 err, func-test 20/20, sweep 16/105 expected (daemon/404/400), a11y 0 violations * chore(prisma): add shadow database config for migrate workflows migrate dev / migrate diff --from-migrations refuse to run without datasource.shadowDatabaseUrl in Prisma 7. Replay DB: airlink_shadow. Baseline 20260910 adopted via migrate resolve (DB built by db push; schema == migrations == live, diff empty) — status now up to date. * fix(addons): quote Addon identifier in raw SQL probes Unquoted `FROM Addon` folds to `addon`; Prisma creates "Addon", so every probe failed and boot logged a bogus "table does not exist — run migrations" warning even though the table exists. * fix(daemon): sign v2 daemon calls Basic+HMAC, seed key >=16 chars fetchDaemon sent Bearer <key>; daemon verifies Basic Airlink:<key> then HMAC v1 -> every v2 daemon route 401'd. Export buildDaemonHeaders, digest-sign bodies, bodyless GET/HEAD. Seed re-applies node key (daemon enforces 16+ chars), addr, port. * checkpoint * rework: major rework in progress --------- Co-authored-by: bthavanish <bthavanish@gmail.com>

…ry with 13 updates Bumps the major-dependencies group with 13 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@dicebear/core](https://github.com/dicebear/dicebear) | `9.4.3` | `10.7.0` | | [@simplewebauthn/browser](https://github.com/MasterKale/SimpleWebAuthn/tree/HEAD/packages/browser) | `13.3.0` | `14.0.0` | | [@simplewebauthn/server](https://github.com/MasterKale/SimpleWebAuthn/tree/HEAD/packages/server) | `13.3.3` | `14.0.3` | | [@xterm/xterm](https://github.com/xtermjs/xterm.js) | `5.5.0` | `6.0.0` | | [boxen](https://github.com/sindresorhus/boxen) | `8.0.1` | `9.0.0` | | [chalk](https://github.com/chalk/chalk) | `5.6.2` | `6.0.1` | | [connect-redis](https://github.com/tj/connect-redis) | `9.0.0` | `10.0.0` | | [dotenv](https://github.com/motdotla/dotenv) | `17.4.2` | `18.0.4` | | [ioredis](https://github.com/redis/ioredis) | `5.11.1` | `6.0.0` | | [nodemailer](https://github.com/nodemailer/nodemailer) | `9.1.1` | `10.0.11` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `25.9.5` | `26.6.3` | | [typescript](https://github.com/microsoft/TypeScript) | `6.0.3` | `7.0.2` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.11` | `5.0.2` | Updates `@dicebear/core` from 9.4.3 to 10.7.0 - [Release notes](https://github.com/dicebear/dicebear/releases) - [Changelog](https://github.com/dicebear/dicebear/blob/11.x/CHANGELOG.md) - [Commits](dicebear/dicebear@v9.4.3...v10.7.0) Updates `@simplewebauthn/browser` from 13.3.0 to 14.0.0 - [Release notes](https://github.com/MasterKale/SimpleWebAuthn/releases) - [Changelog](https://github.com/MasterKale/SimpleWebAuthn/blob/master/CHANGELOG.md) - [Commits](https://github.com/MasterKale/SimpleWebAuthn/commits/v14.0.0/packages/browser) Updates `@simplewebauthn/server` from 13.3.3 to 14.0.3 - [Release notes](https://github.com/MasterKale/SimpleWebAuthn/releases) - [Changelog](https://github.com/MasterKale/SimpleWebAuthn/blob/master/CHANGELOG.md) - [Commits](https://github.com/MasterKale/SimpleWebAuthn/commits/v14.0.3/packages/server) Updates `@xterm/xterm` from 5.5.0 to 6.0.0 - [Release notes](https://github.com/xtermjs/xterm.js/releases) - [Commits](xtermjs/xterm.js@5.5.0...6.0.0) Updates `boxen` from 8.0.1 to 9.0.0 - [Release notes](https://github.com/sindresorhus/boxen/releases) - [Commits](sindresorhus/boxen@v8.0.1...v9.0.0) Updates `chalk` from 5.6.2 to 6.0.1 - [Release notes](https://github.com/chalk/chalk/releases) - [Commits](chalk/chalk@v5.6.2...v6.0.1) Updates `connect-redis` from 9.0.0 to 10.0.0 - [Release notes](https://github.com/tj/connect-redis/releases) - [Commits](tj/connect-redis@v9.0.0...v10.0.0) Updates `dotenv` from 17.4.2 to 18.0.4 - [Changelog](https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md) - [Commits](motdotla/dotenv@v17.4.2...v18.0.4) Updates `ioredis` from 5.11.1 to 6.0.0 - [Release notes](https://github.com/redis/ioredis/releases) - [Changelog](https://github.com/redis/ioredis/blob/main/CHANGELOG.md) - [Commits](redis/ioredis@v5.11.1...v6.0.0) Updates `nodemailer` from 9.1.1 to 10.0.11 - [Release notes](https://github.com/nodemailer/nodemailer/releases) - [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md) - [Commits](nodemailer/nodemailer@v9.1.1...v10.0.11) Updates `@types/node` from 25.9.5 to 26.6.3 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `typescript` from 6.0.3 to 7.0.2 - [Release notes](https://github.com/microsoft/TypeScript/releases) - [Commits](microsoft/TypeScript@v6.0.3...v7.0.2) Updates `vitest` from 4.1.11 to 5.0.2 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.2/packages/vitest) --- updated-dependencies: - dependency-name: "@dicebear/core" dependency-version: 10.7.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: major-dependencies - dependency-name: "@simplewebauthn/browser" dependency-version: 14.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: major-dependencies - dependency-name: "@simplewebauthn/server" dependency-version: 14.0.2 dependency-type: direct:production update-type: version-update:semver-major dependency-group: major-dependencies - dependency-name: "@types/node" dependency-version: 26.6.2 dependency-type: direct:development update-type: version-update:semver-major dependency-group: major-dependencies - dependency-name: "@xterm/xterm" dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: major-dependencies - dependency-name: boxen dependency-version: 9.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: major-dependencies - dependency-name: chalk dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: major-dependencies - dependency-name: connect-redis dependency-version: 10.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: major-dependencies - dependency-name: dotenv dependency-version: 18.0.3 dependency-type: direct:production update-type: version-update:semver-major dependency-group: major-dependencies - dependency-name: ioredis dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: major-dependencies - dependency-name: nodemailer dependency-version: 10.0.10 dependency-type: direct:production update-type: version-update:semver-major dependency-group: major-dependencies - dependency-name: typescript dependency-version: 7.0.2 dependency-type: direct:development update-type: version-update:semver-major dependency-group: major-dependencies - dependency-name: vitest dependency-version: 5.0.1 dependency-type: direct:development update-type: version-update:semver-major dependency-group: major-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions Bot and others added 30 commits August 4, 2026 16:46

ci(release): bump version to 2.5.181

d882300

ci(release): bump version to 2.5.182

9fec13d

fix(api): add 410 stub for missing store uninstall endpoint

50190ba

POST /admin/addons/store/uninstall was fetched by admin-addons.js and store.ejs but had no route (404). Matches its sibling stubs (list/discussions/install) while the addon store is coming soon.

ci(release): bump version to 2.5.183

ce62978

feat(mobile): sheet server/main views with directional stagger + addo…

300cd5a

…n admin links

ci(release): bump version to 2.5.184

c396c60

fix(i18n): add 26 missing en translation keys

6c02819

admin user create/edit/delete flows, api-key page, sidebar nav (Dashboard/Locations), and server edit page referenced keys absent from the canonical en locale (rendered via view fallbacks).

ci(release): bump version to 2.5.185

e085065

ci(release): bump version to 2.5.186

92d7b14

ci(release): bump version to 2.5.187

de9ec43

ci(release): bump version to 2.5.188

09e2b82

ci(release): bump version to 2.5.189

92be259

ci(release): bump version to 2.5.190

3511bf0

ci(release): bump version to 2.5.191

a942b4b

bthavanish and others added 23 commits August 30, 2026 15:04

fix(ci): skip cross-repo daemon tests when daemon dir absent

965ff85

fix(ci): remove broken pnpm cache, use manual actions/cache

4025557

pnpm/action-setup@v4 + setup-node cache:pnpm race condition. Node.js 24 -> 22 (stable). Explicit pnpm version: 11.

chore: trigger full CI pipeline

51db9d3

fix(ci): remove version from pnpm/action-setup to avoid conflict with…

d53add1

… packageManager

fix(setup): PG15+ schema permission denied + npm fallback

ece7f5d

- Add GRANT CREATE ON SCHEMA public (PG15+ removed from GRANT ALL) - Add GRANT ALL ON ALL TABLES/SEQUENCES for existing objects - Detect pnpm or fall back to npm/npx throughout setup

fix(ci): track pnpm-lock.yaml in git

a55afe4

Lockfile was gitignored causing --frozen-lockfile to fail in CI. Removed pnpm-lock.yaml from .gitignore.

fix(ci): fix migration_lock provider mysql→postgresql, remove invalid…

bb3ab8a

… --skip-generate

chore:update README.md

41f6118

chore fix some known issues

c794b65

fix: condense vite build warnings into single log line

6b97134

chore : add db backup to scripts and some cleanup

0d5e7fb

fix: use correct css file built by tailwind

ce3577e

fix :update script to use better ui but its still a bit shit and add …

089108f

…help command

chore:checkpoint commit too many changes so better safe than sorry

7c371c1

Create dependabot.yml

c21c67e

dependabot Bot added the dependencies Pull requests that update a dependency file label Sep 27, 2026

varifocal and others added 2 commits September 30, 2026 17:37

dependabot Bot force-pushed the dependabot/npm_and_yarn/major-dependencies-a7a710c83b branch from 60a8edb to 96c82d6 Compare September 30, 2026 12:15

varifocal force-pushed the main branch from e6bb212 to 39119aa Compare October 2, 2026 05:26

Navigation Menu

Repository navigation

chore(deps)(deps): bump the major-dependencies group across 1 directory with 13 updates - #134

chore(deps)(deps): bump the major-dependencies group across 1 directory with 13 updates#134
dependabot[bot] wants to merge 548 commits into
mainfrom
dependabot/npm_and_yarn/major-dependencies-a7a710c83b

dependabot Bot commented on behalf of github Sep 27, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Sep 27, 2026

Uh oh!

coderabbitai Bot commented Sep 27, 2026 •

edited

Loading

Review skipped

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

dependabot Bot commented on behalf of github Sep 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

DiceBear 10.7 - Release Notes

🎨 Six new avatar styles

Cameo

Gaze

Marbles

Shadows

Slice

Stack

🎮 The core in C#

[10.7.0] - 2026-08-26

Changed

Fixed

[10.7.0-rc.1] - 2026-08-22

Added

v14.0.0 - The one after they go quantum

Breaking Changes

v13.3.3

v13.3.2

v13.3.1

v14.0.0 - The one after they go quantum

v14.0.3

v14.0.2

v14.0.1

v14.0.0 - The one after they go quantum

Breaking Changes

v14.0.3

v14.0.2

v14.0.1

v14.0.0 - The one after they go quantum

6.0.0

Features

Fixes

v9.0.0

Breaking

Improvements

v6.0.1

v6.0.0

Breaking

Improvements

Fixes

v10.0.0

Breaking changes

Maintenance

18.0.4 (2026-09-25)

Changed

18.0.3 (2026-09-22)

Changed

18.0.2 (2026-09-21)

Changed

18.0.1 (2026-09-18)

Changed

18.0.0 (2026-09-17)

Added

Changed

v6.0.0

6.0.0 (2026-07-31)

Bug Fixes

Features

BREAKING CHANGES

v6.0.0-beta.1

6.0.0-beta.1 (2026-07-29)

Bug Fixes

6.0.0 (2026-07-31)

Bug Fixes

Uh oh!

dependabot Bot commented on behalf of github Sep 27, 2026

Labels

Uh oh!

coderabbitai Bot commented Sep 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

dependabot Bot commented on behalf of github Sep 27, 2026 •

edited

Loading

coderabbitai Bot commented Sep 27, 2026 •

edited

Loading