create-mastra 1.13.0 → 1.14.1-alpha.0

package/CHANGELOG.md

@@ -1,5 +1,32 @@
 # create-mastra
 
+## 1.14.1-alpha.0
+
+### Patch Changes
+
+- Security remediation for the 2026-06-17 "easy-day-js" supply-chain incident. Patch bump to publish clean versions and move the `latest` dist-tag forward, superseding the compromised versions that declared the malicious `easy-day-js` dependency. ([#18056](https://github.com/mastra-ai/mastra/pull/18056))
+
+## 1.14.0
+
+### Minor Changes
+
+- Added five Gateway-first templates for documentation search, browser automation, meeting notes, company knowledge, and Claw workspace assistance. ([#17425](https://github.com/mastra-ai/mastra/pull/17425))
+
+  Example:
+
+  ```sh
+  npx create-mastra@latest --template template-docs-expert
+  ```
+
+### Patch Changes
+
+- dependencies updates: ([#17846](https://github.com/mastra-ai/mastra/pull/17846))
+  - Updated dependency [`posthog-node@^5.37.0` ↗︎](https://www.npmjs.com/package/posthog-node/v/5.37.0) (from `^5.30.6`, in `dependencies`)
+
+- Republished clean patch versions after compromised npm releases were published outside of the trusted release workflow. ([#18049](https://github.com/mastra-ai/mastra/pull/18049))
+
+  These packages must be released as clean versions higher than the compromised versions currently present on npm so semver ranges resolve to trusted tarballs.
+
 ## 1.13.0
 
 ## 1.13.0-alpha.4

package/dist/index.js

@@ -11300,30 +11300,47 @@ function requireUtimes () {
 	const u = requireUniversalify().fromPromise;
 
 	async function utimesMillis (path, atime, mtime) {
-	  // if (!HAS_MILLIS_RES) return fs.utimes(path, atime, mtime, callback)
 	  const fd = await fs.open(path, 'r+');
 
-	  let closeErr = null;
+	  let error = null;
 
 	  try {
 	    await fs.futimes(fd, atime, mtime);
+	  } catch (futimesErr) {
+	    error = futimesErr;
 	  } finally {
 	    try {
 	      await fs.close(fd);
-	    } catch (e) {
-	      closeErr = e;
+	    } catch (closeErr) {
+	      if (!error) error = closeErr;
 	    }
 	  }
 
-	  if (closeErr) {
-	    throw closeErr
+	  if (error) {
+	    throw error
 	  }
 	}
 
 	function utimesMillisSync (path, atime, mtime) {
 	  const fd = fs.openSync(path, 'r+');
-	  fs.futimesSync(fd, atime, mtime);
-	  return fs.closeSync(fd)
+
+	  let error = null;
+
+	  try {
+	    fs.futimesSync(fd, atime, mtime);
+	  } catch (futimesErr) {
+	    error = futimesErr;
+	  } finally {
+	    try {
+	      fs.closeSync(fd);
+	    } catch (closeErr) {
+	      if (!error) error = closeErr;
+	    }
+	  }
+
+	  if (error) {
+	    throw error
+	  }
 	}
 
 	utimes = {
@@ -12087,14 +12104,14 @@ function requireLink () {
 	async function createLink (srcpath, dstpath) {
 	  let dstStat;
 	  try {
-	    dstStat = await fs.lstat(dstpath);
+	    dstStat = await fs.lstat(dstpath, { bigint: true });
 	  } catch {
 	    // ignore error
 	  }
 
 	  let srcStat;
 	  try {
-	    srcStat = await fs.lstat(srcpath);
+	    srcStat = await fs.lstat(srcpath, { bigint: true });
 	  } catch (err) {
 	    err.message = err.message.replace('lstat', 'ensureLink');
 	    throw err
@@ -12116,11 +12133,11 @@ function requireLink () {
 	function createLinkSync (srcpath, dstpath) {
 	  let dstStat;
 	  try {
-	    dstStat = fs.lstatSync(dstpath);
+	    dstStat = fs.lstatSync(dstpath, { bigint: true });
 	  } catch {}
 
 	  try {
-	    const srcStat = fs.lstatSync(srcpath);
+	    const srcStat = fs.lstatSync(srcpath, { bigint: true });
 	    if (dstStat && areIdentical(srcStat, dstStat)) return
 	  } catch (err) {
 	    err.message = err.message.replace('lstat', 'ensureLink');
@@ -12324,18 +12341,18 @@ function requireSymlink () {
 	    // (standard symlink behavior) or fall back to cwd if that doesn't exist
 	    let srcStat;
 	    if (path$1.isAbsolute(srcpath)) {
-	      srcStat = await fs.stat(srcpath);
+	      srcStat = await fs.stat(srcpath, { bigint: true });
 	    } else {
 	      const dstdir = path$1.dirname(dstpath);
 	      const relativeToDst = path$1.join(dstdir, srcpath);
 	      try {
-	        srcStat = await fs.stat(relativeToDst);
+	        srcStat = await fs.stat(relativeToDst, { bigint: true });
 	      } catch {
-	        srcStat = await fs.stat(srcpath);
+	        srcStat = await fs.stat(srcpath, { bigint: true });
 	      }
 	    }
 
-	    const dstStat = await fs.stat(dstpath);
+	    const dstStat = await fs.stat(dstpath, { bigint: true });
 	    if (areIdentical(srcStat, dstStat)) return
 	  }
 
@@ -12361,18 +12378,18 @@ function requireSymlink () {
 	    // (standard symlink behavior) or fall back to cwd if that doesn't exist
 	    let srcStat;
 	    if (path$1.isAbsolute(srcpath)) {
-	      srcStat = fs.statSync(srcpath);
+	      srcStat = fs.statSync(srcpath, { bigint: true });
 	    } else {
 	      const dstdir = path$1.dirname(dstpath);
 	      const relativeToDst = path$1.join(dstdir, srcpath);
 	      try {
-	        srcStat = fs.statSync(relativeToDst);
+	        srcStat = fs.statSync(relativeToDst, { bigint: true });
 	      } catch {
-	        srcStat = fs.statSync(srcpath);
+	        srcStat = fs.statSync(srcpath, { bigint: true });
 	      }
 	    }
 
-	    const dstStat = fs.statSync(dstpath);
+	    const dstStat = fs.statSync(dstpath, { bigint: true });
 	    if (areIdentical(srcStat, dstStat)) return
 	  }
 
@@ -13488,13 +13505,55 @@ function requireQuote () {
 	if (hasRequiredQuote) return quote;
 	hasRequiredQuote = 1;
 
+	var OPS = [
+		'||',
+		'&&',
+		';;',
+		'|&',
+		'<(',
+		'<<<',
+		'>>',
+		'>&',
+		'<&',
+		'&',
+		';',
+		'(',
+		')',
+		'|',
+		'<',
+		'>'
+	];
+	var LINE_TERMINATORS = /[\n\r\u2028\u2029]/;
+	var GLOB_SHELL_SPECIAL = /[\s#!"$&'():;<=>@\\^`|]/g;
+
 	quote = function quote(xs) {
 		return xs.map(function (s) {
 			if (s === '') {
 				return '\'\'';
 			}
 			if (s && typeof s === 'object') {
-				return s.op.replace(/(.)/g, '\\$1');
+				if (s.op === 'glob') {
+					if (typeof s.pattern !== 'string') {
+						throw new TypeError('glob token requires a string `pattern`');
+					}
+					if (LINE_TERMINATORS.test(s.pattern)) {
+						throw new TypeError('glob `pattern` must not contain line terminators');
+					}
+					return s.pattern.replace(GLOB_SHELL_SPECIAL, '\\$&');
+				}
+				if (typeof s.op === 'string') {
+					if (OPS.indexOf(s.op) < 0) {
+						throw new TypeError('invalid `op` value: ' + JSON.stringify(s.op));
+					}
+					return s.op.replace(/[\s\S]/g, '\\$&');
+				}
+				if (typeof s.comment === 'string') {
+					if (LINE_TERMINATORS.test(s.comment)) {
+						throw new TypeError('`comment` must not contain line terminators');
+					}
+					return '#' + s.comment;
+				}
+				throw new TypeError('unrecognized object token shape');
 			}
 			if ((/["\s\\]/).test(s) && !(/'/).test(s)) {
 				return "'" + s.replace(/(['])/g, '\\$1') + "'";
@@ -15783,7 +15842,7 @@ var PinoLogger = class _PinoLogger extends MastraLogger {
 };
 
 var package_default = {
-  version: "1.13.0"};
+  version: "1.14.1-alpha.0"};
 var logger = createLogger(false);
 function createLogger(debug = false) {
   return new PinoLogger({