@namzu/sandbox 17.0.1 → 18.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +37 -0
- package/package.json +4 -4
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,42 @@
|
|
|
1
1
|
# @namzu/sandbox
|
|
2
2
|
|
|
3
|
+
## 18.0.0
|
|
4
|
+
|
|
5
|
+
### Patch Changes
|
|
6
|
+
|
|
7
|
+
- Updated dependencies [e83dfe5]
|
|
8
|
+
- Updated dependencies [9661d16]
|
|
9
|
+
- @namzu/sdk@43.0.0
|
|
10
|
+
|
|
11
|
+
## 17.0.2
|
|
12
|
+
|
|
13
|
+
### Patch Changes
|
|
14
|
+
|
|
15
|
+
- 8d5223b: Nothing a consumer installs or calls changes, and that is the whole of this
|
|
16
|
+
release. `vitest` moves from `^3.2.6` to `^4.1.11` in the `devDependencies` of
|
|
17
|
+
all nineteen packages that declared it, and `@vitest/coverage-v8` moves with it
|
|
18
|
+
in `@namzu/sdk`. Every occurrence is a devDependency — checked, not assumed —
|
|
19
|
+
so `dependencies`, `peerDependencies`, exports, types, defaults and the wire
|
|
20
|
+
shape are untouched, and the published tarballs differ from the previous
|
|
21
|
+
release only in `package.json#devDependencies`.
|
|
22
|
+
|
|
23
|
+
The reason is a security fix with no 3.x backport. `GHSA-82fw-gwwq-j7x9`
|
|
24
|
+
("Path Traversal / Arbitrary File Read via `@vitest/mocker` Redirect Mock")
|
|
25
|
+
covers `vitest` and `@vitest/mocker` from `2.1.0` up to `4.1.11`, so `^3.2.6`
|
|
26
|
+
can only be resolved by leaving the 3.x line. `4.1.11` is the first patched
|
|
27
|
+
release and is what the lockfile now resolves for both.
|
|
28
|
+
|
|
29
|
+
What this costs anyone who works on the repository rather than with it: the
|
|
30
|
+
upgrade was not a version bump. Vitest 4 changed test discovery, coverage
|
|
31
|
+
configuration, mock construction and reporter output, and each of those broke
|
|
32
|
+
something here that had to be migrated rather than worked around. Those fixes
|
|
33
|
+
are all under `__tests__/`, `vitest.config.ts` files and `scripts/`, none of
|
|
34
|
+
which is published, which is why this is a patch and not a major.
|
|
35
|
+
|
|
36
|
+
You do not need to do anything. If you pin `vitest` yourself to run this
|
|
37
|
+
project's own suites, note that the config files it ships are now written for
|
|
38
|
+
`>= 4.1.11` and will not run under 3.x.
|
|
39
|
+
|
|
3
40
|
## 17.0.1
|
|
4
41
|
|
|
5
42
|
### Patch Changes
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@namzu/sandbox",
|
|
3
|
-
"version": "
|
|
3
|
+
"version": "18.0.0",
|
|
4
4
|
"description": "Pluggable sandbox provider for @namzu/sdk. Process-level isolation (bubblewrap on Linux, Seatbelt on macOS, via @anthropic-ai/sandbox-runtime) for developer dev loops; container-level isolation (HTTP worker + a loopback-bound egress proxy that allows by resolved address and brokers outbound credentials so they never enter the sandbox) for multi-tenant production. Backend selected at construction time; the SDK consumes both through the same SandboxProvider interface.",
|
|
5
5
|
"license": "FSL-1.1-MIT",
|
|
6
6
|
"engines": {
|
|
@@ -46,15 +46,15 @@
|
|
|
46
46
|
"provenance": true
|
|
47
47
|
},
|
|
48
48
|
"peerDependencies": {
|
|
49
|
-
"@namzu/sdk": "^
|
|
49
|
+
"@namzu/sdk": "^43.0.0"
|
|
50
50
|
},
|
|
51
51
|
"devDependencies": {
|
|
52
52
|
"@biomejs/biome": "^1.9.4",
|
|
53
53
|
"@types/node": "^22.19.17",
|
|
54
54
|
"typescript": "^5.5.0",
|
|
55
|
-
"vitest": "^
|
|
55
|
+
"vitest": "^4.1.11",
|
|
56
56
|
"yaml": "^2.9.0",
|
|
57
|
-
"@namzu/sdk": "^
|
|
57
|
+
"@namzu/sdk": "^43.0.0"
|
|
58
58
|
},
|
|
59
59
|
"scripts": {
|
|
60
60
|
"build": "tsc --build",
|