Search code, repositories, users, issues, pull requests...

TypeScript definitions for vscode

Microsoft/vsce (@vscode/vsce)

3.7.2-12 -> 3.9.2-3

`v3.9.2-3`

Changes:

#1274: Run npm audit fix

This list of changes was auto generated.

Released by joaomoreno on 5/14/2026

`v3.9.2-2`

Changes:

#1272: Bump fast-uri from 3.0.6 to 3.1.2

This list of changes was auto generated.

Released by joaomoreno on 5/11/2026

`v3.9.2-1`

Changes:

#1267: Bump minimatch from 10.2.2 to 10.2.3

This list of changes was auto generated.

Released by joaomoreno on 4/20/2026

capricorn86/happy-dom (happy-dom)

20.8.9 -> 20.9.0

`v20.9.0`

🎨 Features

Adds support for event listener properties on Window (e.g. Window.onkeydown) - By capricorn86 in task #2131

Released by capricorn86 on 4/13/2026

isomorphic-dompurify

3.11.0 -> 3.14.0

Makes it possible to use DOMPurify on server and client in the same way.

📦 View on npm

jsdom/jsdom (jsdom)

29.0.1 -> 29.1.1

`v29.1.1`

Fixed 'border-radius' computed style serialization. (asamuzaK)
Fixed computed style computation when using 'background-origin' and 'background-clip' CSS properties. (asamuzaK)
Significantly optimized initial calls to getComputedStyle(), before the cache warms up. (asamuzaK)

Released by domenic on 4/30/2026

`v29.1.0`

Added basic support for the ratio CSS type. (asamuzaK)
Fixed getComputedStyle() sometimes returning outdated results after CSS was modified. (asamuzaK)

Released by domenic on 4/27/2026

`v29.0.2`

Significantly improved and sped up getComputedStyle(). Computed value rules are now applied across a broader set of properties, and include fixes related to inheritance, defaulting keywords, custom properties, and color-related values such as currentcolor and system colors. (asamuzaK)
Fixed CSS 'background' and 'border' shorthand parsing. (asamuzaK)

Released by domenic on 4/7/2026

harttle/liquidjs (liquidjs)

10.25.7 -> 10.27.0

`v10.27.0`

10.27.0 (2026-05-15)

Features

context: null-prototype scope frames via createScope (#899) (47d3f1b)

Released by github-actions[bot] on 5/15/2026

`v10.26.0`

10.26.0 (2026-05-14)

Bug Fixes

date: cap strftime widths and account padding in memoryLimit (#895) (3129d46)
enforce renderLimit for empty renderTemplates calls (#894) (5b9c346)
propagate ownPropertyOnly into Context.spawn() for {% render %} (#893) (dbbf628)
security: block Object.prototype filter/tag lookups (RCE) (#897) (457fae0)
strip html newline tags (#892) ([26ea285](https://github.com/harttle/liquidjs/commit/...

[View full release notes]

Released by github-actions[bot] on 5/14/2026

`v10.9.4`

10.9.4 (2023-11-04)

Bug Fixes

allow unicode to be identifiers, fixes #655 (dd7616a)

Released by github-actions[bot] on 11/4/2023

markdown-it/markdown-it (markdown-it)

14.1.1 -> 14.2.0

Markdown-it - modern pluggable markdown parser.

websockets/ws (ws)

8.20.0 -> 8.21.0

`8.21.0`

Features

Introduced the maxBufferedChunks and maxFragments options (2b2abd45).

Bug fixes

Fixed a remote memory exhaustion DoS vulnerability (2b2abd45).

A high volume of tiny fragments and data chunks could be sent by a peer, using
modest network traffic, to crash a ws server or client due to OOM.

import { WebSocket, WebSocketServer } from 'ws';

const wss = new WebSocketServer({ port: 0 }, function () {
  const data = Buffer.alloc(1);
  const options = { fin: false };
  const { port } = wss.address();
  const ws = new WebSocket(`ws://localhost:${port}`);

  ws.on('open', function () {
    (function send() {
      ws.send(data, options, function (err) {
        if (err) return;
        send();
      });
    })();
  });

  ws.on('error', console.error);
  ws.on('close', function (code, reason) {
    console.log(`client close - code: ${code} reason: ${reason.toString()}`);
  });
});

wss.on('connection', function (ws) {
  ws.on('error', console.error);
  ws.on('c...

*[View full release notes]*

*Released by [lpinca](https://github.com/lpinca) on 5/22/2026*

### [`8.20.1`](https://github.com/websockets/ws/releases/tag/8.20.1)

[Compare Source](https://github.com/websockets/ws/compare/v8.20.0...v8.21.0)

# Bug fixes

- Fixed an uninitialized memory disclosure issue in `websocket.close()`
  (c0327ec1).

Providing a `TypedArray` (e.g. `Float32Array`) as the `reason` argument for
`websocket.close()`, rather than the supported string or `Buffer` types, caused
uninitialized memory to be disclosed to the remote peer.

```js
import { deepStrictEqual } from 'node:assert';
import { WebSocket, WebSocketServer } from 'ws';

const wss = new WebSocketServer(
  { port: 0, skipUTF8Validation: true },
  function () {
    const { port } = wss.address();
    const ws = new WebSocket(`ws://localhost:${port}`, {
      skipUTF8Validation: true
    });

    ws.on('close', function (code, reason) {
      deepStrictEqual(reason, Buffer.alloc(80));
    });
  }
);

wss.on('connection', function (ws) {
  ws.close(1000, new Float32Array(20));
});

The issue was privately reported by Nikita Skovoroda.

Released by lpinca on 5/12/2026

`8.9.0`

Features

Added the ability to connect to Windows named pipes (#2079).

Released by lpinca on 9/22/2022

ionic-team/capacitor (@capacitor/android)

8.3.0 -> 8.3.4

`9.0.0-alpha.2`

9.0.0-alpha.2 (2026-05-12)

Note: Version bump only for package capacitor

Released by jcesarmobile on 5/12/2026

`8.3.4`

8.3.4 (2026-05-12)

Note: Version bump only for package capacitor

Released by jcesarmobile on 5/12/2026

`9.0.0-alpha.1`

9.0.0-alpha.1 (2026-05-08)

Note: Version bump only for package capacitor

Released by jcesarmobile on 5/8/2026

ionic-team/capacitor (@capacitor/cli)

8.3.0 -> 8.3.4

`9.0.0-alpha.2`

9.0.0-alpha.2 (2026-05-12)

Note: Version bump only for package capacitor

Released by jcesarmobile on 5/12/2026

`8.3.4`

8.3.4 (2026-05-12)

Note: Version bump only for package capacitor

Released by jcesarmobile on 5/12/2026

`9.0.0-alpha.1`

9.0.0-alpha.1 (2026-05-08)

Note: Version bump only for package capacitor

Released by jcesarmobile on 5/8/2026

ionic-team/capacitor (@capacitor/core)

8.3.0 -> 8.3.4

`9.0.0-alpha.2`

9.0.0-alpha.2 (2026-05-12)

Note: Version bump only for package capacitor

Released by jcesarmobile on 5/12/2026

`8.3.4`

8.3.4 (2026-05-12)

Note: Version bump only for package capacitor

Released by jcesarmobile on 5/12/2026

`9.0.0-alpha.1`

9.0.0-alpha.1 (2026-05-08)

Note: Version bump only for package capacitor

Released by jcesarmobile on 5/8/2026

ionic-team/capacitor (@capacitor/ios)

8.3.0 -> 8.3.4

`9.0.0-alpha.2`

9.0.0-alpha.2 (2026-05-12)

Note: Version bump only for package capacitor

Released by jcesarmobile on 5/12/2026

`8.3.4`

8.3.4 (2026-05-12)

Note: Version bump only for package capacitor

Released by jcesarmobile on 5/12/2026

`9.0.0-alpha.1`

9.0.0-alpha.1 (2026-05-08)

Note: Version bump only for package capacitor

Released by jcesarmobile on 5/8/2026

ionic-team/capacitor-keyboard (@capacitor/keyboard)

8.0.2 -> 8.0.3

`v8.0.3`

8.0.3 (2026-04-10)

Bug Fixes

android: fixing Keyboard interaction with SystemBars (#62) (4afd89b)

This release is also available on:

[npm package (latest dist-tag)](https://www.npmjs.com/package/@capacitor/keyboard/v/8.0.3)

Released by capacitor-bot on 4/10/2026

cwcss/crosswind (@cwcss/crosswind)

0.2.0 -> 0.2.4

`v0.2.4`

Compare changes

🚀 Features

rules: table display family, flow-root/list-item/contents, arbitrary accent/caret (f31d55c)

🧹 Chores

release v0.2.4 (09382bd)

Contributors

Chris chrisbreuer93@gmail.com

Released by github-actions[bot] on 5/1/2026

`v0.2.3`

Compare changes

🧹 Chores

release v0.2.3 (0af1adb)
split and minify dist (23aef98)

Contributors

Chris chrisbreuer93@gmail.com

Released by github-actions[bot] on 5/1/2026

`v0.2.2`

Compare changes

🐛 Bug Fixes

build: emit dist/index.js + dist/cli.js to match exports/bin paths (1544b47)

🧹 Chores

release v0.2.2 (a0ceda7)

Contributors

Chris chrisbreuer93@gmail.com

Released by github-actions[bot] on 5/1/2026

iconify/icon-sets (@iconify/json)

2.2.468 -> 2.2.479

Hundreds of open source icon sets in IconifyJSON format

stacksjs/clapp (@stacksjs/clapp)

0.2.6 -> 0.2.10

`v0.2.10`

Released by github-actions[bot] on 5/14/2026

`v0.2.9`

Released by github-actions[bot] on 5/11/2026

`v0.2.8`

Released by github-actions[bot] on 5/6/2026

stacksjs/ts-cloud (@stacksjs/ts-cloud)

0.2.3 -> 0.2.15

`v0.2.15`

Released by github-actions[bot] on 5/10/2026

`v0.2.9`

Released by github-actions[bot] on 5/3/2026

`v0.2.8`

Released by github-actions[bot] on 5/3/2026

DefinitelyTyped/DefinitelyTyped (@types/bun)

1.3.13 -> 1.3.14

TypeScript definitions for bun

oven-sh/bun (bun)

1.3.13 -> 1.3.14

`bun-v1.3.14`

To install Bun v1.3.14

curl -fsSL https://bun.sh/install | bash
# or you can use npm
# npm install -g bun

Windows:

powershell -c "irm bun.sh/install.ps1|iex"

To upgrade to Bun v1.3.14:

bun upgrade

Read Bun v1.3.14's release notes on Bun's blog

Thanks to 11 contributors!

[190n](https://github.com/190n)
[alii](https://github.com/alii)
[carlsmedstad](https://github.com/carlsmedstad)
[cirospaciari](https://github.com/cirospaciari)
[coleleavitt](https://github.com/coleleavitt)
[djs5008](https://github.com/djs5008)
[dylan-conway](https://github.com/dylan-conway)
[ig-ant](https://github.com/ig-ant)
[[Jarred-Sumner](https://github.com/Jarred-Sumn...

[View full release notes]

Released by Jarred-Sumner on 5/13/2026

`bun-v1.3.13`

To install Bun v1.3.13

curl -fsSL https://bun.sh/install | bash
# or you can use npm
# npm install -g bun

Windows:

powershell -c "irm bun.sh/install.ps1|iex"

To upgrade to Bun v1.3.13:

bun upgrade

Read Bun v1.3.13's release notes on Bun's blog

Thanks to 8 contributors!

Released by Jarred-Sumner on 4/20/2026

`bun-v1.3.12`

To install Bun v1.3.12

curl -fsSL https://bun.sh/install | bash
# or you can use npm
# npm install -g bun

Windows:

powershell -c "irm bun.sh/install.ps1|iex"

To upgrade to Bun v1.3.12:

bun upgrade

Read Bun v1.3.12's release notes on Bun's blog

Thanks to 8 contributors!

Released by dylan-conway on 4/10/2026

stacksjs/bunfig (bunfig)

0.15.11 -> 0.15.13

`v0.15.13`

Released by github-actions[bot] on 5/8/2026

`v0.15.12`

Released by github-actions[bot] on 5/8/2026

`v0.15.9`

Released by github-actions[bot] on 4/29/2026

cure53/DOMPurify (dompurify)

3.4.2 -> 3.4.6

`3.4.6`

Fixed several issues with DOM Clobbering in IN_PLACE mode, thanks offset & Bankde
Hardened the checks for cross-realm IN_PLACE and Shadow DOM sanitization, thanks offset & Bankde
Added more test coverage for IN_PLACE and general DOM Clobbering attacks
Bumped several dependencies where possible

Released by cure53 on 5/26/2026

`3.4.5`

Fixed a bypass caused by the new HTML element selectedcontent added in 3.4.4, thanks KabirAcharya

Note that this is a security release for an issue introduced in 3.4.4 and should be upgraded to immediately.

Released by cure53 on 5/18/2026

`3.4.4`

Added the selectedcontent element to default allow-list, thanks lukewarlow
Added the command and commandfor attributes to default allowed-list, thanks lukewarlow
Added better template scrubbing for IN_PLACE operations, thanks DEMON1A
Added stronger checks for cross-realm windows, thanks DEMON1A & fg0x0
Updated demo website and made sure it uses the latest from main
Updated existing workflows, fuzzer, dependabot, etc., added more tests
Bumped several dependencies where possible

🚨 This release had been flagged as deprecated, please use DOMPurify 3.4.5 instead 🚨

Released by cure53 on 5/17/2026

pickier/pickier (pickier)

0.1.25 -> 0.1.32

`v0.1.32`

Released by github-actions[bot] on 5/21/2026

`v0.1.29`

Released by github-actions[bot] on 5/8/2026

`v0.1.28`

Released by github-actions[bot] on 5/2/2026

prettier/prettier (prettier)

3.8.1 -> 3.8.3

`3.8.3`

SCSS: Prevent trailing comma in if() function (prettier/prettier#18471 by [kovsu](https://github.com/kovsu))

🔗 Changelog

Released by fisker on 4/15/2026

`3.8.2`

Support Angular v21.2

🔗 Changelog

Released by fisker on 4/10/2026

`4.0.0-alpha.3`

diff

Released by sosukesuzuki on 12/1/2023

apostrophecms/apostrophe (sanitize-html)

2.17.3 -> 2.17.4

Clean up user-submitted HTML, preserving allowlisted elements and allowlisted attributes on a per-element basis

tinybench

6.0.1 -> 6.0.2

🔎 A simple, tiny and lightweight benchmarking library!

📦 View on npm

ts-broadcasting

0.0.4 -> 0.0.5

📦 View on npm

Microsoft/vscode-languageserver-node (vscode-languageserver-textdocument)

1.0.12 -> 1.0.13

`release/types/3.17.6-next.7`

Released by joaomoreno on 5/26/2026

`release/textDocument/1.0.13`

Changes:

Bugs:

#752: Edits are applied twice

Others:

#1775: Update dependencies and improve compatibility
#1774: Bump qs from 6.15.0 to 6.15.2
#1773: Implement TextDocumentSnapshot for delay open notifications
#1772: Prevent pulling diagnostics on untitled documents
#1770: Update documentation and fix lint errors
#1767: Inline value documentation improvements
#1769: Fix glob pattern documentation

See More

#1768: Make document color requests consistent with the specification
#1766: Add optional MarkupContent support to diagnostics
#1751: forgetDocument is crashing the extension host
#1765: Fixes #1751: Prevent crash in forgetDocument when disposed
#1752: fix: random pipe path length extends limit on macos
#1764: Fixes double application of edits during renaming
#1762: Bump brace-expansion from 5.0.3 to 5.0.6 in /client
#1763: Bump brace-expansion from 5.0.5 to 5.0.6 in /c...

[View full release notes]

Released by joaomoreno on 5/26/2026

`release/protocol/3.17.6-next.18`