Skip to content

chore(deps): bump the security-updates group across 1 directory with 8 updates - #76

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/security-updates-f04bfc0772
Open

chore(deps): bump the security-updates group across 1 directory with 8 updates#76
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/security-updates-f04bfc0772

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 11, 2026

Copy link
Copy Markdown

Bumps the security-updates group with 8 updates in the / directory:

Package From To
@hono/node-server 1.19.17 2.1.3
hono 4.12.32 4.13.11
@vitest/mocker 3.2.7 5.1.0
adm-zip 0.5.18 removed
zod 3.25.76 4.6.7
esbuild 0.27.7 0.28.1
source-map-js 1.2.1 1.2.2
vite 7.3.6 8.3.8

Updates @hono/node-server from 1.19.17 to 2.1.3

Release notes

Sourced from @​hono/node-server's releases.

v2.1.3

Security fixes

serveStatic decodes the request path a second time, leading to bypass of middleware on static paths

Affects: @hono/node-server/serve-static. Fixes serveStatic decoding an already-decoded path, where a crafted request could be routed as one path and served as another, skipping middleware mounted on a static prefix. GHSA-rmxm-3fg6-px4f

serveStatic now rejects request paths that still contain % after decoding. To serve files whose names contain a literal %, set allowPercentInPath: true.

The same fix ships in hono v4.13.11.

v2.1.2

What's Changed

Full Changelog: honojs/node-server@v2.1.1...v2.1.2

v2.1.1

What's Changed

Full Changelog: honojs/node-server@v2.1.0...v2.1.1

v2.1.0

What's Changed

New Contributors

Full Changelog: honojs/node-server@v2.0.12...v2.1.0

v2.0.12

What's Changed

Full Changelog: honojs/node-server@v2.0.11...v2.0.12

v2.0.11

... (truncated)

Commits

Updates hono from 4.12.32 to 4.13.11

Release notes

Sourced from hono's releases.

v4.13.11

Security fixes

serveStatic decodes the request path a second time, leading to bypass of middleware on static paths

Affects: hono/serve-static and the adapters built on it (hono/bun, hono/deno, hono/cloudflare-workers, @hono/bun, @hono/deno, @hono/cloudflare-workers). Fixes serveStatic decoding an already-decoded path, where a crafted request could be routed as one path and served as another, skipping middleware mounted on a static prefix. GHSA-5r4p-p66f-jhc7

serveStatic now rejects request paths that still contain % after decoding. To serve files whose names contain a literal %, set allowPercentInPath: true.

The same fix ships in @hono/node-server v2.1.3.

v4.13.10

Adapters are now separate packages

The runtime adapters are now published as their own packages: @hono/bun, @hono/deno, @hono/cloudflare-workers, @hono/aws-lambda, @hono/lambda-edge, @hono/netlify, @hono/vercel, and @hono/service-worker. @hono/deno is also on JSR.

hono/<adapter> still works in v4 but is deprecated and will be removed in v5. Migrating is an import change:

- import { serveStatic } from 'hono/bun'
+ import { serveStatic } from '@hono/bun'

hono/cloudflare-pages is deprecated without a replacement package; Cloudflare recommends Workers with static assets.

What's Changed

Full Changelog: honojs/hono@v4.13.9...v4.13.10

v4.13.9

What's Changed

  • fix(jsx): replace Suspense and ErrorBoundary content across newlines in honojs/hono#5380

... (truncated)

Commits

Updates @vitest/mocker from 3.2.7 to 5.1.0

Release notes

Sourced from @​vitest/mocker's releases.

v5.1.0

   🚀 Features

   🐞 Bug Fixes

... (truncated)

Commits

Removes adm-zip

Updates zod from 3.25.76 to 4.6.7

Release notes

Sourced from zod's releases.

v4.6.7

Commits:

  • b500a2ee95134f81d74da7911d7378dd2853d042 4.6.7

v4.6.6

Six malicious commits pushed to main on September 21 with a compromised git credential were reverted the same day in #6620 and have since been removed from the history of main. None were ever published to npm. The npm provenance for 4.6.6 names 284243fb, the pre-rewrite copy of 9c219833 with identical contents.

Commits:

  • 0cd3af5e9f50ad11bbcd4407a46a21b8848ba574 docs: load the en locale directly in Zod Mini
  • 9d5e60f162997b764b40d45aa02481888db50dea docs: import locales from zod/locales, not z.locales
  • 34a626f307871ecbb0123947559328dc52ed5e3e docs: tighten the z.locales tree-shaking note
  • 74304ce5b5796b5edb9a88ceb8e170b6ea3e82df release: stage npm versions instead of publishing them (#6622)
  • b2ef983e0711ff6517d6020b021071e2e5653efa docs: add Code for Japan to bronze sponsors
  • 8fb2faf0584828a6a027d8279db36f6f52784462 docs: crop the Code for Japan logo and list it first in bronze
  • bacad518c41610d654658172d325874bf0ee6290 docs: square the Code for Japan logo to match the other bronze tiles
  • c42596bd1c87e941d7241d10e012c5c196adcc10 release: hold the run on the release-approval environment until the staged versions are approved (#6638)
  • a2ba4a67986a3e6b2b131be30084a2f460d9ea67 fix(types): declare record output and input as members, not base type arguments (#6645)
  • a0ebf970f2d752e5f58527cd2942ff48be4f46bd fix(v4): check array, set and map size bounds before parsing elements (#6652)
  • 529f78dd9431b07f49647fee3aa0819b3f8b66b7 4.6.6
  • 9c219833c3a3764fa1f1ea9c5ecec8254a63c0b1 ci: stage at verbose so a failed OIDC token exchange says why

v4.6.5

Commits:

  • d2b135cfb7a3582b9eb515756b9166bcb9521f4a docs: add the 4.6.x patch highlights to the 4.6 post
  • f1448f7cee00df9fe1e9ad84a000aa1828cc8bc1 docs: fold the 4.6.x patch highlights into the 4.6 post's own sections
  • de65a5cb39ed22a507fac935788f718fa88d104f docs: lead the properties section with the check and add a Zod Mini tab (#6598)
  • 56222cd1532c07bcb91b67df529cab4c0a215330 feat(instanceof): key the .properties() shape off the instance type (#6600)
  • ca0229a404818290e6cdcfefcd7eb2d04bcbb543 Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)"
  • cc4cd4ee9c52fcaa10964e48cc144541e41a5ed9 Revert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)""
  • 0f3f5ee3ca56c7574bf849e54f79e9a6e02562ee 4.6.5
  • 59bbc03e10c636b9eb3c393dfeb552819774ec21 chore: re-pin the integration peers to the workspace zod after the 4.6.5 bump

v4.6.4

A patch on top of 4.6.3.

  • d6bc1e30 feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)
  • ad32d751 perf: z.url() rejects an invalid URL with URL.canParse() instead of a throwing constructor, about 50x faster; fewer allocations on the validation path (#6588)
  • 2bb08717 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump
  • f6e1701a chore(deps): bump next to 15.5.25 and vite to 7.3.6 (#6153)

v4.6.3

A patch on top of 4.6.2.

  • 413cce9a fix(v4): make z.properties() a check again (#6594) — removes the standalone z.properties() schema from 4.6.0; z.instanceof().properties() and .check(...z.properties()) are unchanged
  • 75d63ee1 docs: show only the .properties() method form in the 4.6 post
  • 46da9572 docs: match the error-message examples to what the parsers emit

... (truncated)

Commits
  • b500a2e 4.6.7
  • 9c21983 ci: stage at verbose so a failed OIDC token exchange says why
  • 529f78d 4.6.6
  • a0ebf97 fix(v4): check array, set and map size bounds before parsing elements (#6652)
  • a2ba4a6 fix(types): declare record output and input as members, not base type argumen...
  • c42596b release: hold the run on the release-approval environment until the staged ve...
  • bacad51 docs: square the Code for Japan logo to match the other bronze tiles
  • 8fb2faf docs: crop the Code for Japan logo and list it first in bronze
  • b2ef983 docs: add Code for Japan to bronze sponsors
  • 74304ce release: stage npm versions instead of publishing them (#6622)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for zod since your current version.


Updates esbuild from 0.27.7 to 0.28.1

Release notes

Sourced from esbuild's releases.

v0.28.1

  • Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

    This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

    Thanks to @​dellalibera for reporting this issue.

  • Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

    The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.

    Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.

    Thanks to @​sondt99 for reporting this issue.

  • Avoid inlining using and await using declarations (#4482)

    Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:

    // Original code
{
  using x = new Resource()
  x.activate()
}

    // Old output (with --minify)
    
new Resource().activate();
    

    // New output (with --minify)
    
{using e=new Resource;e.activate()}

  • Fix module evaluation when an error is thrown (#4461, #4467)

    If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.

  • Fix some edge cases around the new operator (#4477)

    Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:

    // Original code
new (foo()`bar`)()
new (foo()?.bar)()

    // Old output
    
new foo()bar();
    
new (foo())?.bar();

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.28.1

  • Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

    This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

    Thanks to @​dellalibera for reporting this issue.

  • Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

    The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.

    Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.

    Thanks to @​sondt99 for reporting this issue.

  • Avoid inlining using and await using declarations (#4482)

    Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:

    // Original code
{
  using x = new Resource()
  x.activate()
}

    // Old output (with --minify)
    
new Resource().activate();
    

    // New output (with --minify)
    
{using e=new Resource;e.activate()}

  • Fix module evaluation when an error is thrown (#4461, #4467)

    If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.

  • Fix some edge cases around the new operator (#4477)

    Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:

    // Original code
new (foo()`bar`)()
new (foo()?.bar)()

    // Old output
    
new foo()bar();
    
new (foo())?.bar();

... (truncated)

Commits

Updates source-map-js from 1.2.1 to 1.2.2

Release notes

Sourced from source-map-js's releases.

v1.2.2

Changelog

Sourced from source-map-js's changelog.

1.2.2

Commits

Updates vite from 7.3.6 to 8.3.8

Release notes

Sourced from vite's releases.

v8.3.8

Bug Fixes

  • build: keep magicString and ast in transform hook meta (#24012) (a3b28e8)
  • bundled-dev: emit assets referenced by inline workers during load (#23103) (5e50bae)
  • config: skip native loader compat checks for type-only imports (#24021) (e554294)
  • css: reject CSS entrypoints when build.cssCodeSplit: false (#23112) (e4ad62b)
  • deps: update all non-major dependencies (#24027) (a13aa04)
  • hide console window when running yarn config get on Windows (#24013) (3f6c4cd)

Performance Improvements

  • css: import sass once instead of per file (#24041) (db8b119)
  • defer net use until a UNC path is resolved on Windows (#24014) (b643046)

Miscellaneous Chores

Code Refactoring

  • optimizer: use non-capturing group for external types regex (#24048) (ef23433)

Tests

v8.3.7

Bug Fixes

Miscellaneous Chores

Tests

Build System

v8.3.6

Bug Fixes

... (truncated)

Changelog

Sourced from vite's changelog.

8.3.8 (2026-11-11)

Bug Fixes

  • build: keep magicString and ast in transform hook meta (#24012) (a3b28e8)
  • bundled-dev: emit assets referenced by inline workers during load (#23103) (5e50bae)
  • config: skip native loader compat checks for type-only imports (#24021) (e554294)
  • css: reject CSS entrypoints when build.cssCodeSplit: false (#23112) (e4ad62b)
  • deps: update all non-major dependencies (#24027) (a13aa04)
  • hide console window when running yarn config get on Windows (#24013) (3f6c4cd)

Performance Improvements

  • css: import sass once instead of per file (#24041) (db8b119)
  • defer net use until a UNC path is resolved on Windows (#24014) (b643046)

Miscellaneous Chores

Code Refactoring

  • optimizer: use non-capturing group for external types regex (

@dependabot
chore(deps): bump the security-updates group across 1 directory with …
e258843 
…8 updates

Bumps the security-updates group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@hono/node-server](https://github.com/honojs/node-server) | `1.19.17` | `2.1.3` |
| [hono](https://github.com/honojs/hono) | `4.12.32` | `4.13.11` |
| [@vitest/mocker](https://github.com/vitest-dev/vitest/tree/HEAD/packages/mocker) | `3.2.7` | `5.1.0` |
| [adm-zip](https://github.com/cthackers/adm-zip) | `0.5.18` | `removed` |
| [zod](https://github.com/colinhacks/zod) | `3.25.76` | `4.6.7` |
| [esbuild](https://github.com/evanw/esbuild) | `0.27.7` | `0.28.1` |
| [source-map-js](https://github.com/7rulnik/source-map-js) | `1.2.1` | `1.2.2` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `7.3.6` | `8.3.8` |



Updates `@hono/node-server` from 1.19.17 to 2.1.3
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](honojs/node-server@v1.19.17...v2.1.3)

Updates `hono` from 4.12.32 to 4.13.11
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.12.32...v4.13.11)

Updates `@vitest/mocker` from 3.2.7 to 5.1.0
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.1.0/packages/mocker)

Removes `adm-zip`

Updates `zod` from 3.25.76 to 4.6.7
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v3.25.76...v4.6.7)

Updates `esbuild` from 0.27.7 to 0.28.1
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md)
- [Commits](evanw/esbuild@v0.27.7...v0.28.1)

Updates `source-map-js` from 1.2.1 to 1.2.2
- [Release notes](https://github.com/7rulnik/source-map-js/releases)
- [Changelog](https://github.com/7rulnik/source-map-js/blob/main/CHANGELOG.md)
- [Commits](7rulnik/source-map-js@v1.2.1...v1.2.2)

Updates `vite` from 7.3.6 to 8.3.8
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.3.8/packages/vite)

---
updated-dependencies:
- dependency-name: "@hono/node-server"
  dependency-version: 2.1.3
  dependency-type: direct:production
  dependency-group: security-updates
- dependency-name: hono
  dependency-version: 4.13.11
  dependency-type: direct:production
  dependency-group: security-updates
- dependency-name: "@vitest/mocker"
  dependency-version: 5.1.0
  dependency-type: indirect
  dependency-group: security-updates
- dependency-name: adm-zip
  dependency-version:
  dependency-type: indirect
  dependency-group: security-updates
- dependency-name: zod
  dependency-version: 4.6.7
  dependency-type: indirect
  dependency-group: security-updates
- dependency-name: esbuild
  dependency-version: 0.28.1
  dependency-type: indirect
  dependency-group: security-updates
- dependency-name: source-map-js
  dependency-version: 1.2.2
  dependency-type: indirect
  dependency-group: security-updates
- dependency-name: vite
  dependency-version: 8.3.8
  dependency-type: indirect
  dependency-group: security-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from jack-arturo as a code owner November 11, 2026 16:05
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 11, 2026
@github-actions github-actions Bot added the needs-human-review Requires human review before merge label Nov 11, 2026
@jack-arturo jack-arturo mentioned this pull request Nov 11, 2026
Merged
jack-arturo added a commit that referenced this pull request Nov 11, 2026
@jack-arturo
chore: release 0.4.0 (#80)
12cfd45 
🤖 I have created a release *beep* *boop*
---


##
[0.4.0](browser-hand-v0.3.0...browser-hand-v0.4.0)
(2026-11-11)


### Features

* add --ignore-https-errors flag for self-signed certs
([#79](#79))
([1a66133](1a66133))
* add page.cua (vision) and page.domCua (DOM-id) toolsets
([#114](https://github.com/verygoodplugins/browser-hand/issues/114))
([a2cbafb](a2cbafb))
* add Windows x64 support and npm packaging
([#66](#66))
([0817e87](0817e87))
* **brand:** add ghost-glove identity, GitHub banner, and toolbar icons
([61a5d55](61a5d55))
* **brand:** add ghost-glove identity, GitHub banner, and toolbar icons
([f4b07ad](f4b07ad))
* **brand:** crop mist out of the toolbar glove
([90f38d4](90f38d4))
* **brand:** crop mist out of the toolbar glove
([745e109](745e109))
* clean up idle managed browsers
([#124](https://github.com/verygoodplugins/browser-hand/issues/124))
([0038e98](0038e98))
* **cli:** add `close` to shut tabs Browser Hand opened
([422306e](422306e))
* **cli:** add `close` to shut tabs Browser Hand opened
([dc457ee](dc457ee)),
closes [#31](#31)
* **cli:** add snapshot, doctor, and click contract helpers
([be06af4](be06af4))
* **cli:** add snapshot, doctor, and click contract helpers
([9c3b7c3](9c3b7c3))
* **cli:** compact JSON stdout and gym compare puppeteer driver
([c40d628](c40d628))
* **cli:** compact JSON stdout and gym compare puppeteer driver
([d1b756c](d1b756c))
* **cli:** launch throwaway browsers from the one connected to the relay
([598b8df](598b8df))
* **cli:** launch throwaway browsers from the one connected to the relay
([a8422df](a8422df))
* **cli:** list forms first in snapshots
([9fe71c2](9fe71c2))
* **cli:** list forms first in snapshots
([c01c162](c01c162))
* **cli:** pass an optional tab group title
([d2b067e](d2b067e))
* **cli:** pass an optional tab group title
([b31451a](b31451a))
* **cli:** run a form as one steps call
([d05e11a](d05e11a))
* **cli:** run a form as one steps call
([cc485a5](cc485a5))
* **cli:** wire scoped snapshot, compact doctor, and click handles
([6eedb0e](6eedb0e))
* **cli:** wire scoped snapshot, compact doctor, and click handles
([7bf51ab](7bf51ab))
* dev-browser CLI
([9ddbc13](9ddbc13))
* **extension:** add an optional titled tab group
([2b44893](2b44893))
* **extension:** add an optional titled tab group
([86ce655](86ce655))
* **extension:** debugger-free page control so Browser Hand works in
Search
([682f6bf](682f6bf))
* **extension:** debugger-free page control so Browser Hand works in
Search
([3603bf6](3603bf6))
* **gym:** add vanilla Playwright as a benchmark-only compare driver
([477e197](477e197))
* **gym:** add vanilla Playwright as a benchmark-only compare driver
([b527514](b527514))
* rebrand as Browser Hand and land Path A extension
([01d83f7](01d83f7))
* self-contained Path A stack (CLI + relay + skill + live smoke)
([874de65](874de65))
* target the connected browser, not Chrome by default
([#29](#29))
([#30](#30))
([7b02d50](7b02d50))


### Bug Fixes

* add install lock to prevent concurrent npm install corruption
([#76](#76))
([f9ee211](f9ee211))
* bound browser requests and streamline agent actions
([#118](https://github.com/verygoodplugins/browser-hand/issues/118))
([a5ecfca](a5ecfca))
* bound listPages title lookup
([#72](#72))
([ea752ba](ea752ba))
* **brand:** clear mist pixels inside the glove crop
([be39dc4](be39dc4))
* **brand:** clear only the plume under the wrist
([1e97b11](1e97b11))
* **brand:** crop the toolbar glove to the solid bone
([5db5b97](5db5b97))
* build daemon bundles before Rust compilation in release workflow
([80880ab](80880ab))
* **cli:** accept a closed combobox that holds the requested value
([2fc7ea3](2fc7ea3))
* **cli:** accept a committed non-ASCII combobox value
([ba956af](ba956af))
* **cli:** adopt only a unique exact URL and drop stale tab ids
([89e3c3b](89e3c3b))
* **cli:** attach to an existing named page on click/type, never create
one
([068f2e1](068f2e1))
* **cli:** await scripting eval and assign date values atomically
([d022a72](d022a72))
* **cli:** bound steps and keep snapshot and evaluate data
([c654c4b](c654c4b))
* **cli:** cap combobox typing delay under the relay timeout
([f5440a6](f5440a6))
* **cli:** cap snapshot forms and skip hidden iframes
([c0f862a](c0f862a))
* **cli:** clip inventory only and honor target.name on tabs
([e662137](e662137))
* **cli:** compare select options and text writes exactly
([948efa8](948efa8))
* **cli:** confine the label-read mutation, cancel interrupted pointers,
recheck disabled
([bf3ff1b](bf3ff1b))
* **cli:** correct the shadow-form test to match native association
([953ac73](953ac73))
* **cli:** disabled controls, occluded ranking, repeated aria-hidden
text
([fc63adc](fc63adc))
* **cli:** do not attach a control whose form id is missing
([3dd75c6](3dd75c6))
* **cli:** do not bind a shadow field to a light-DOM form id
([a32623d](a32623d))
* **cli:** do not fill a field that only shares a word
([776c167](776c167))
* **cli:** do not reload a tab that was just opened at its URL
([1bfaf2d](1bfaf2d))
* **cli:** drop mouseMoved, reject stale targets, clamp the settle knob
([e890a7b](e890a7b))
* **cli:** exclude aria-hidden by hiding and re-reading; stop a click
mid-sequence
([1eaad04](1eaad04))
* **cli:** fail autofill when a written field does not stick
([96bd834](96bd834))
* **cli:** fail combobox fill unless a scoped option is selected
([812c94f](812c94f))
* **cli:** fail fill when a field misses
([1397aa0](1397aa0))
* **cli:** fail fill when a field misses
([e8103ae](e8103ae))
* **cli:** group an existing tab when goto sets a title
([792a7b1](792a7b1))
* **cli:** honor --target-id on tabs and stop over-claiming last-focused
([2c1deb0](2c1deb0))
* **cli:** include shadow and iframe fields in snapshot forms
([7a7cd43](7a7cd43))
* **cli:** keep a non-matching app alias from hiding the real bundle
([7894c28](7894c28))
* **cli:** keep formatted secrets out of step snapshots
([ac0ffdd](ac0ffdd))
* **cli:** keep label-chaos matches and honest combobox readback
([e06d9a5](e06d9a5))
* **cli:** keep named goto as create-or-reuse
([5f7eb47](5f7eb47))
* **cli:** keep nav shadows out and name range inputs
([480756d](480756d))
* **cli:** keep shadow labels and form-associated controls together
([b6c9c93](b6c9c93))
* **cli:** keep snapshot names, refs, and expanded state
([a69da64](a69da64))
* **cli:** keep snapshot roots and names inside the right tree
([6b11256](6b11256))
* **cli:** keep strategy:first in source order
([cdf5cfd](cdf5cfd))
* **cli:** keep unicode and punctuation in fill read-back
([44d862e](44d862e))
* **cli:** keep unicode, punctuation, and missing form ids honest
([31fbbca](31fbbca))
* **cli:** keep validation alerts in the scoped snapshot
([b6e7e12](b6e7e12))
* **cli:** leave shadow inputs off the outer form
([056d112](056d112))
* **cli:** let close see about:blank and file:// tabs
([1d06543](1d06543))
* **cli:** list every tab and target the last-focused one
([19e91fc](19e91fc))
* **cli:** list every tab and target the last-focused one
([6808ac6](6808ac6))
* **cli:** omit password values from snapshot nodes
([8b3e0c0](8b3e0c0))
* **cli:** port hidden-tab click refinement and add click-matching tests
([05a3a45](05a3a45))
* **cli:** preserve evaluate payload and click warnings in --quiet
([c1405ac](c1405ac))
* **cli:** re-rank corrected candidates, enforce the candidate cap per
node
([b8322ce](b8322ce))
* **cli:** refuse covered role clicks and publish implicit roles
([4268762](4268762))
* **cli:** reject empty --query instead of listing every tab
([f7eb1c5](f7eb1c5))
* **cli:** resolve role clicks with the default snapshot refs
([5472dd3](5472dd3))
* **cli:** reuse an open tab instead of minting a blank one
([63bf1ae](63bf1ae))
* **cli:** reuse an open tab instead of minting a blank one
([8cb1cc1](8cb1cc1))
* **cli:** score before visibility, keep disabled exact matches, use
:disabled
([ebc276c](ebc276c))
* **cli:** share one combobox typing budget across a fill
([35fda4f](35fda4f))
* **cli:** share the snapshot field cap across iframes
([1fca5ab](1fca5ab))
* **cli:** skip covered controls in snapshot refs and role clicks
([d542c88](d542c88))
* **cli:** stop snapshot and evaluate from minting named tabs
([d6a8880](d6a8880))
* **cli:** stop snapshot and evaluate from minting named tabs
([339cbe9](339cbe9))
* **cli:** substitute step placeholders and keep evaluate fields
([04fae76](04fae76))
* **cli:** sync click semantics and second-round Codex fixes from
autohub
([7bac3d9](7bac3d9))
* **cli:** type fill with insertText and select combobox options
([71bf490](71bf490))
* **cli:** type fill with insertText and select combobox options
([f066795](f066795))
* **cli:** walk the full ranked set, and never re-send a delivered
release
([3b73c69](3b73c69))
* daemon hardening — frame cap, browser-stop lock, cold-start race,
Chrome 147 CDP attach
([#115](https://github.com/verygoodplugins/browser-hand/issues/115))
([edba515](edba515))
* **daemon:** expect the example.com sentence the locator actually
returns
([a86c2d0](a86c2d0))
* **daemon:** read example.com body text instead of a removed heading
([46953fe](46953fe))
* disable viewport emulation in headed mode
([#87](https://github.com/verygoodplugins/browser-hand/issues/87))
([2122b02](2122b02))
* **docs:** run doctor from repo root in challenge gym
([0f1d377](0f1d377))
* **extension:** fall back when a cached tab group cannot be reused
([6c01790](6c01790))
* **extension:** leave a dismissed debugger bar dismissed
([5ba09c9](5ba09c9))
* **extension:** leave a dismissed debugger bar dismissed
([6b60db9](6b60db9))
* **extension:** run user-script evaluate synchronously first so it
works in Search
([7154ad0](7154ad0))
* **extension:** stamp last-focused tab on live inventory
([b806723](b806723))
* **extension:** stamp last-focused tab on live inventory
([b9040d0](b9040d0))
* **extension:** stop chrome:// attach spam and empty error logs
([3192866](3192866))
* **extension:** sync-first user-script evaluate so CSP-strict pages
work in Search
([3263e65](3263e65))
* finish the Browser Hand cutover and land the click-targeting fix
([893b2be](893b2be))
* finish the Browser Hand cutover, repair the CLI binary, land the
click-targeting fix
([3c4fd95](3c4fd95))
* **gym:** default upstream bin to repo launcher
([88e2672](88e2672))
* **gym:** keep auto-started challenge server on loopback
([009632b](009632b))
* **gym:** reject bad --driver and probe a real challenge page
([5fe1f13](5fe1f13))
* **gym:** require clean CLI run before counting a pass
([e9e2c25](e9e2c25))
* **gym:** skip redundant BH combobox click on challenge 20
([d10431c](d10431c))
* handle EBUSY on Windows test cleanup
([b12e2f7](b12e2f7))
* increase timeout for navigation test on Windows CI
([b8e592f](b8e592f))
* make install-skill work in non-interactive environments
([#84](https://github.com/verygoodplugins/browser-hand/issues/84))
([94748ec](94748ec))
* pin playwright to 1.58.2 to prevent protocol drift
([#95](https://github.com/verygoodplugins/browser-hand/issues/95))
([5459700](5459700))
* read innerText for labels, revalidate before dispatch, atomic
named-page attach
([081bc2a](081bc2a))
* **relay:** do not close a user tab from an adopted session
([c9ebee8](c9ebee8))
* **relay:** keep a reused tab when the client closes its page
([94c982c](94c982c))
* **relay:** wait for a fresh tab to commit before reporting success
([51f0b0a](51f0b0a))
* **release:** cut the GitHub release without publishing to npm
([1371270](1371270))
* **release:** publish a public manifest from the private repo root
([e6c467b](e6c467b))
* resolve Windows CI test timeout in sandbox-file-io
([7f94dae](7f94dae))
* **skill:** agents + resources frontmatter for AutoVault admission
([683cffc](683cffc))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jack-arturo jack-arturo Awaiting requested review from jack-arturo jack-arturo is a code owner

At least 0 approving reviews are required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code needs-human-review Requires human review before merge

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants