@namzu/cli 26.0.0 → 26.0.1

package/CHANGELOG.md

@@ -1,5 +1,47 @@
 # @namzu/cli
 
+## 26.0.1
+
+### Patch Changes
+
+- 8d5223b: Nothing a consumer installs or calls changes, and that is the whole of this
+  release. `vitest` moves from `^3.2.6` to `^4.1.11` in the `devDependencies` of
+  all nineteen packages that declared it, and `@vitest/coverage-v8` moves with it
+  in `@namzu/sdk`. Every occurrence is a devDependency — checked, not assumed —
+  so `dependencies`, `peerDependencies`, exports, types, defaults and the wire
+  shape are untouched, and the published tarballs differ from the previous
+  release only in `package.json#devDependencies`.
+
+  The reason is a security fix with no 3.x backport. `GHSA-82fw-gwwq-j7x9`
+  ("Path Traversal / Arbitrary File Read via `@vitest/mocker` Redirect Mock")
+  covers `vitest` and `@vitest/mocker` from `2.1.0` up to `4.1.11`, so `^3.2.6`
+  can only be resolved by leaving the 3.x line. `4.1.11` is the first patched
+  release and is what the lockfile now resolves for both.
+
+  What this costs anyone who works on the repository rather than with it: the
+  upgrade was not a version bump. Vitest 4 changed test discovery, coverage
+  configuration, mock construction and reporter output, and each of those broke
+  something here that had to be migrated rather than worked around. Those fixes
+  are all under `__tests__/`, `vitest.config.ts` files and `scripts/`, none of
+  which is published, which is why this is a patch and not a major.
+
+  You do not need to do anything. If you pin `vitest` yourself to run this
+  project's own suites, note that the config files it ships are now written for
+  `>= 4.1.11` and will not run under 3.x.
+
+- Updated dependencies [175dab2]
+- Updated dependencies [8d5223b]
+  - @namzu/sdk@42.0.2
+  - @namzu/anthropic@5.1.2
+  - @namzu/computer-use@1.4.3
+  - @namzu/deepseek@1.2.1
+  - @namzu/files@1.1.1
+  - @namzu/google@0.3.1
+  - @namzu/ollama@2.2.3
+  - @namzu/openai@3.1.2
+  - @namzu/openrouter@2.4.1
+  - @namzu/zen@2.1.1
+
 ## 26.0.0
 
 ### Major Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@namzu/cli",
-  "version": "26.0.0",
+  "version": "26.0.1",
   "description": "Interactive and headless terminal agent for Namzu, with provider discovery, durable sessions, tools and diagnostics.",
   "keywords": [
     "namzu",
@@ -46,16 +46,16 @@
     "react": "19.2.6",
     "string-width": "8.2.1",
     "yaml": "^2.9.0",
-    "@namzu/anthropic": "5.1.1",
-    "@namzu/computer-use": "1.4.2",
-    "@namzu/deepseek": "^1.2.0",
-    "@namzu/files": "1.1.0",
-    "@namzu/ollama": "2.2.2",
-    "@namzu/openai": "3.1.1",
-    "@namzu/openrouter": "2.4.0",
-    "@namzu/sdk": "^42.0.0",
-    "@namzu/google": "^0.3.0",
-    "@namzu/zen": "^2.0.0"
+    "@namzu/anthropic": "5.1.2",
+    "@namzu/computer-use": "1.4.3",
+    "@namzu/deepseek": "^1.2.1",
+    "@namzu/files": "1.1.1",
+    "@namzu/ollama": "2.2.3",
+    "@namzu/openai": "3.1.2",
+    "@namzu/openrouter": "2.4.1",
+    "@namzu/sdk": "^42.0.2",
+    "@namzu/google": "^0.3.1",
+    "@namzu/zen": "^2.1.1"
   },
   "devDependencies": {
     "@biomejs/biome": "^1.9.4",
@@ -63,8 +63,8 @@
     "@xterm/headless": "^6.0.0",
     "ink-testing-library": "^4.0.0",
     "typescript": "^5.5.0",
-    "vitest": "^3.2.6",
-    "@namzu/telemetry": "2.2.0"
+    "vitest": "^4.1.11",
+    "@namzu/telemetry": "2.2.1"
   },
   "engines": {
     "node": ">=22.13.0"