2.26.2

Security 🔒

• (deps) Bump uuid to ^14.0.0 (fix GHSA-w5hq-g745-h8pq) by @BYK in #810

Bug Fixes 🐛

• (prepare) Remove --allow-remote-config gate by @BYK in #809

Internal Changes 🔧

• (deps) Bump astro from 5.18.1 to 6.1.6 in /docs by @dependabot in #806
• (deps-dev) Bump fast-xml-parser from 5.5.7 to 5.7.0 by @dependabot in #808

2.26.1

Security 🔒

• (release-env) Allowlist GITHUB_* and RUNNER_* by prefix by @BYK in #807

Bug Fixes 🐛

• (npm) Tolerate workspace:* deps in version bump and bun.lock patching by @BYK in #805

Internal Changes 🔧

• Fix Node 20 + app-id deprecation warnings, refresh Node matrix by @BYK in #803

2.26.0

Security 🔒

• (ci) Pin third-party GitHub Actions to commit SHAs by @BYK in #801
• (commit-repo) Replace execSync tar with node-tar by @BYK in #799
• (gpg) Pipe private key via stdin instead of writing to /tmp by @BYK in #798
• (publish) Move publish-state file out of repo cwd by @BYK in #797
• (spawn) Strip dynamic-linker env vars from subprocess env by @BYK in #800

New Features ✨

• Recognize security: commit prefix for changelog and versioning by @BYK in #802

2.25.5

Bug Fixes 🐛

Security

• Move workflow to pull_request and do not persist creds by @geoffg-sentry in #796
• Disable .craft.env reading and harden release subprocess env by @BYK in #794

2.25.4

Bug Fixes 🐛

• (publish) Replace CRAFT_NEW_VERSION with CRAFT_RELEASED_VERSION in post-release env by @BYK in #793

2.25.3

Bug Fixes 🐛

• (deps) Address security vulnerabilities in vite, picomatch, and defu by @BYK in #791
• (publish) Distinguish auth failures from merge conflicts in post-publish merge by @BYK in #788

2.25.2

Bug Fixes 🐛

• Preserve HTML blocks (e.g., <img> tags from GitHub image uploads) in custom ## Changelog Entry PR sections instead of silently dropping them. by @BYK in #786
• (deps) Bump brace-expansion from 5.0.4 to 5.0.5 by @BYK in #787
• Upgrade GitHub Actions to Node.js 24 compatible versions by @BYK in #784

Internal Changes 🔧

• (deps) Bump astro from 5.16.11 to 5.18.1 in /docs by @dependabot in #785

2.25.1

Bug Fixes 🐛

• (deps) Address smol-toml DoS vulnerability (GHSA-v3rj-xjv7-4jmq) by @BYK in #783
• Commit changelog even when preReleaseCommand returns false by @BYK in #781

Internal Changes 🔧

• Reformat codebase with Prettier and add CI enforcement by @BYK in #782

2.25.0

New Features ✨

• (registry) Require and validate registry metadata on first publish by @s1gr1d in #777

Bug Fixes 🐛

• (deps) Address security advisories for fast-xml-parser, h3, and flatted by @BYK in #780
• (publish) Make post-publish merge failure non-fatal with resolve strategy retry by @BYK in #778

Internal Changes 🔧

• (deps-dev) Bump fast-xml-parser from 5.3.8 to 5.5.7 by @dependabot in #779

2.24.2

Bug Fixes 🐛

• (deps) Address security advisories for flatted and devalue by @BYK in #775
• (prepare) Handle scoped tag prefixes in auto version resolution by @BYK in #773

Internal Changes 🔧

• Update CI actions from Node.js 20 SHA pins to latest by @BYK in #774