claude-threads 1.17.1 → 1.17.3

package/CHANGELOG.md

@@ -7,6 +7,23 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.17.3] - 2026-07-01
+
+### Dependencies
+- **Production:** `@hono/node-server` 2.0.5 → 2.0.6, `hono` 4.12.26 → 4.12.27, `semver` 7.8.4 → 7.8.5. (#417)
+- **Dev:** `@types/node` 25 → 26, `typescript-eslint` 8.61.1 → 8.62.1. (#416)
+
+### Changed
+- **Held `js-yaml` on 4.x and added a dependabot ignore for `js-yaml >=5.0.0`.** Dependabot grouped a `js-yaml` 4.x → 5.x major into the production bump, but 5.x is ESM-only and dropped the CommonJS `default` export, breaking our `import yaml from 'js-yaml'` call sites with `Missing 'default' export`. The bump now stays on 4.x until the code migrates to named ESM imports. (#417)
+- **CI:** `actions/checkout` 6 → 7. (#413)
+
+### Security
+- **`@hono/node-server` 2.0.4 → 2.0.5** to resolve GHSA-frvp-7c67-39w9: on Windows, prefix-mounted Serve Static middleware could be bypassed. Only affects Windows deployments using Serve Static. (#408)
+
+### Dependencies
+- **Production:** `hono` 4.12.25 → 4.12.26, `semver` 7.8.1 → 7.8.4. (#408)
+- **Dev:** `@types/node` 25.9.1 → 25.9.3, `@types/react` 19.2.16 → 19.2.17, `eslint` 10.4.1 → 10.5.0, `prettier` 3.8.3 → 3.8.4, `typescript-eslint` 8.60.1 → 8.61.1. (#409)
+
 ## [1.17.1] - 2026-06-19
 
 ### Fixed

package/dist/index.js

@@ -7203,6 +7203,18 @@ var require_semver = __commonJS((exports, module) => {
   var { safeRe: re, t } = require_re();
   var parseOptions = require_parse_options();
   var { compareIdentifiers } = require_identifiers();
+  var isPrereleaseIdentifier = (prerelease, identifier) => {
+    const identifiers = identifier.split(".");
+    if (identifiers.length > prerelease.length) {
+      return false;
+    }
+    for (let i2 = 0;i2 < identifiers.length; i2++) {
+      if (compareIdentifiers(prerelease[i2], identifiers[i2]) !== 0) {
+        return false;
+      }
+    }
+    return true;
+  };
 
   class SemVer {
     constructor(version, options) {
@@ -7442,8 +7454,9 @@ var require_semver = __commonJS((exports, module) => {
             if (identifierBase === false) {
               prerelease = [identifier];
             }
-            if (compareIdentifiers(this.prerelease[0], identifier) === 0) {
-              if (isNaN(this.prerelease[1])) {
+            if (isPrereleaseIdentifier(this.prerelease, identifier)) {
+              const prereleaseBase = this.prerelease[identifier.split(".").length];
+              if (isNaN(prereleaseBase)) {
                 this.prerelease = prerelease;
               }
             } else {
@@ -8032,20 +8045,22 @@ var require_range = __commonJS((exports, module) => {
     return comp;
   };
   var isX = (id) => !id || id.toLowerCase() === "x" || id === "*";
+  var invalidXRangeOrder = (M, m, p) => isX(M) && !isX(m) || isX(m) && p && !isX(p);
   var replaceTildes = (comp, options) => {
     return comp.trim().split(/\s+/).map((c) => replaceTilde(c, options)).join(" ");
   };
   var replaceTilde = (comp, options) => {
     const r = options.loose ? re[t.TILDELOOSE] : re[t.TILDE];
+    const z = options.includePrerelease ? "-0" : "";
     return comp.replace(r, (_, M, m, p, pr) => {
       debug("tilde", comp, _, M, m, p, pr);
       let ret;
       if (isX(M)) {
         ret = "";
       } else if (isX(m)) {
-        ret = `>=${M}.0.0 <${+M + 1}.0.0-0`;
+        ret = `>=${M}.0.0${z} <${+M + 1}.0.0-0`;
       } else if (isX(p)) {
-        ret = `>=${M}.${m}.0 <${M}.${+m + 1}.0-0`;
+        ret = `>=${M}.${m}.0${z} <${M}.${+m + 1}.0-0`;
       } else if (pr) {
         debug("replaceTilde pr", pr);
         ret = `>=${M}.${m}.${p}-${pr} <${M}.${+m + 1}.0-0`;
@@ -8091,9 +8106,9 @@ var require_range = __commonJS((exports, module) => {
         debug("no pr");
         if (M === "0") {
           if (m === "0") {
-            ret = `>=${M}.${m}.${p}${z} <${M}.${m}.${+p + 1}-0`;
+            ret = `>=${M}.${m}.${p} <${M}.${m}.${+p + 1}-0`;
           } else {
-            ret = `>=${M}.${m}.${p}${z} <${M}.${+m + 1}.0-0`;
+            ret = `>=${M}.${m}.${p} <${M}.${+m + 1}.0-0`;
           }
         } else {
           ret = `>=${M}.${m}.${p} <${+M + 1}.0.0-0`;
@@ -8112,6 +8127,9 @@ var require_range = __commonJS((exports, module) => {
     const r = options.loose ? re[t.XRANGELOOSE] : re[t.XRANGE];
     return comp.replace(r, (ret, gtlt, M, m, p, pr) => {
       debug("xRange", comp, ret, gtlt, M, m, p, pr);
+      if (invalidXRangeOrder(M, m, p)) {
+        return comp;
+      }
       const xM = isX(M);
       const xm = xM || isX(m);
       const xp = xm || isX(p);

package/dist/mcp/mcp-server.js

@@ -12269,6 +12269,18 @@ var require_semver = __commonJS((exports, module) => {
   var { safeRe: re, t } = require_re();
   var parseOptions = require_parse_options();
   var { compareIdentifiers } = require_identifiers();
+  var isPrereleaseIdentifier = (prerelease, identifier) => {
+    const identifiers = identifier.split(".");
+    if (identifiers.length > prerelease.length) {
+      return false;
+    }
+    for (let i = 0;i < identifiers.length; i++) {
+      if (compareIdentifiers(prerelease[i], identifiers[i]) !== 0) {
+        return false;
+      }
+    }
+    return true;
+  };
 
   class SemVer {
     constructor(version3, options) {
@@ -12508,8 +12520,9 @@ var require_semver = __commonJS((exports, module) => {
             if (identifierBase === false) {
               prerelease = [identifier];
             }
-            if (compareIdentifiers(this.prerelease[0], identifier) === 0) {
-              if (isNaN(this.prerelease[1])) {
+            if (isPrereleaseIdentifier(this.prerelease, identifier)) {
+              const prereleaseBase = this.prerelease[identifier.split(".").length];
+              if (isNaN(prereleaseBase)) {
                 this.prerelease = prerelease;
               }
             } else {
@@ -13098,20 +13111,22 @@ var require_range = __commonJS((exports, module) => {
     return comp;
   };
   var isX = (id) => !id || id.toLowerCase() === "x" || id === "*";
+  var invalidXRangeOrder = (M, m, p) => isX(M) && !isX(m) || isX(m) && p && !isX(p);
   var replaceTildes = (comp, options) => {
     return comp.trim().split(/\s+/).map((c) => replaceTilde(c, options)).join(" ");
   };
   var replaceTilde = (comp, options) => {
     const r = options.loose ? re[t.TILDELOOSE] : re[t.TILDE];
+    const z2 = options.includePrerelease ? "-0" : "";
     return comp.replace(r, (_, M, m, p, pr) => {
       debug("tilde", comp, _, M, m, p, pr);
       let ret;
       if (isX(M)) {
         ret = "";
       } else if (isX(m)) {
-        ret = `>=${M}.0.0 <${+M + 1}.0.0-0`;
+        ret = `>=${M}.0.0${z2} <${+M + 1}.0.0-0`;
       } else if (isX(p)) {
-        ret = `>=${M}.${m}.0 <${M}.${+m + 1}.0-0`;
+        ret = `>=${M}.${m}.0${z2} <${M}.${+m + 1}.0-0`;
       } else if (pr) {
         debug("replaceTilde pr", pr);
         ret = `>=${M}.${m}.${p}-${pr} <${M}.${+m + 1}.0-0`;
@@ -13157,9 +13172,9 @@ var require_range = __commonJS((exports, module) => {
         debug("no pr");
         if (M === "0") {
           if (m === "0") {
-            ret = `>=${M}.${m}.${p}${z2} <${M}.${m}.${+p + 1}-0`;
+            ret = `>=${M}.${m}.${p} <${M}.${m}.${+p + 1}-0`;
           } else {
-            ret = `>=${M}.${m}.${p}${z2} <${M}.${+m + 1}.0-0`;
+            ret = `>=${M}.${m}.${p} <${M}.${+m + 1}.0-0`;
           }
         } else {
           ret = `>=${M}.${m}.${p} <${+M + 1}.0.0-0`;
@@ -13178,6 +13193,9 @@ var require_range = __commonJS((exports, module) => {
     const r = options.loose ? re[t.XRANGELOOSE] : re[t.XRANGE];
     return comp.replace(r, (ret, gtlt, M, m, p, pr) => {
       debug("xRange", comp, ret, gtlt, M, m, p, pr);
+      if (invalidXRangeOrder(M, m, p)) {
+        return comp;
+      }
       const xM = isX(M);
       const xm = xM || isX(m);
       const xp = xm || isX(p);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-threads",
-  "version": "1.17.1",
+  "version": "1.17.3",
   "description": "Share Claude Code sessions live in a Mattermost channel with interactive features",
   "main": "dist/index.js",
   "type": "module",
@@ -63,7 +63,7 @@
     "package.json"
   ],
   "dependencies": {
-    "@hono/node-server": "2.0.4",
+    "@hono/node-server": "2.0.6",
     "@inkjs/ui": "^2.0.0",
     "@modelcontextprotocol/sdk": "^1.26.0",
     "@redactpii/node": "^1.0.16",
@@ -71,13 +71,13 @@
     "commander": "^14.0.2",
     "diff": "^8.0.3",
     "express-rate-limit": "^8.3.0",
-    "hono": "4.12.25",
+    "hono": "4.12.27",
     "ink": "^6.6.0",
     "ink-scroll-view": "^0.3.5",
     "js-yaml": "^4.1.1",
     "prompts": "^2.4.2",
     "react": "^19.2.3",
-    "semver": "7.8.1",
+    "semver": "7.8.5",
     "update-notifier": "^7.3.1",
     "ws": "8.21.0",
     "zod": "^4.3.6"
@@ -86,7 +86,7 @@
     "@eslint/js": "^10.0.1",
     "@types/bun": "latest",
     "@types/js-yaml": "^4.0.9",
-    "@types/node": "^25.0.3",
+    "@types/node": "^26.0.1",
     "@types/prompts": "^2.4.9",
     "@types/react": "^19.2.7",
     "@types/semver": "^7.7.1",