Version Packages

examples/nextjs-basic/CHANGELOG.md

@@ -1,5 +1,12 @@
 # @senderkit-examples/nextjs-basic
 
+## 0.0.11
+
+### Patch Changes
+
+- Updated dependencies [1fe3c66]
+  - @senderkit/sdk@0.10.0
+
 ## 0.0.10
 
 ### Patch Changes

examples/nextjs-basic/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@senderkit-examples/nextjs-basic",
-  "version": "0.0.10",
+  "version": "0.0.11",
   "private": true,
   "scripts": {
     "dev": "next dev",

examples/node-basic/CHANGELOG.md

@@ -1,5 +1,12 @@
 # @senderkit-examples/node-basic
 
+## 0.0.11
+
+### Patch Changes
+
+- Updated dependencies [1fe3c66]
+  - @senderkit/sdk@0.10.0
+
 ## 0.0.10
 
 ### Patch Changes

examples/node-basic/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@senderkit-examples/node-basic",
-  "version": "0.0.10",
+  "version": "0.0.11",
   "private": true,
   "type": "module",
   "scripts": {

packages/cli/CHANGELOG.md

@@ -1,5 +1,41 @@
 # @senderkit/cli
 
+## 0.6.3
+
+### Patch Changes
+
+- 505e36c: Resolve `pnpm audit` advisories by bumping vulnerable transitive dependencies.
+  - **`hono`** → `>=4.12.25` (pnpm override). Pulled in at runtime via
+    `@modelcontextprotocol/sdk`; clears 5 advisories (GHSA-wwfh-h76j-fc44,
+    GHSA-j6c9-x7qj-28xf, GHSA-rv63-4mwf-qqc2, GHSA-wgpf-jwqj-8h8p,
+    GHSA-88fw-hqm2-52qc).
+  - **`js-yaml`** → `>=4.2.0` (pnpm override). Dev-only, via `@changesets/cli`
+    (GHSA-h67p-54hq-rp68).
+  - **`vite`** → `^8.0.16`, pinned as a direct devDependency in the three
+    test packages. Dev-only, via `vitest` (GHSA-fx2h-pf6j-xcff,
+    GHSA-v6wh-96g9-6wx3). An override alone doesn't move it because `vite` is
+    both a dependency and a peerDependency of `vitest`, so the version is pinned
+    where the peer is consumed instead.
+
+  `pnpm audit --audit-level=moderate` now reports no known vulnerabilities.
+
+- 1fe3c66: Add the `blocked` message status introduced by the outbound abuse scanner.
+
+  senderkit-app now runs outbound anti-phishing detection over email and SMS
+  content. A flagged send is halted and the message lands in a new terminal
+  `blocked` state with a human-readable `blockedReason`. This brings the SDK,
+  CLI, and MCP surface back in lockstep with the app's `messageStatusEnum`.
+  - **`MESSAGE_STATUSES`** now includes `blocked` (between `opted_out` and
+    `canceled`), mirroring the app enum. The `senderkit_messages_list.status`
+    MCP/CLI filter is a strict `z.enum(MESSAGE_STATUSES)`, so before this change
+    it rejected `status: "blocked"` as invalid input — callers can now filter for
+    blocked messages.
+  - **`Message.blockedReason`** is documented on the message type (optional
+    `string | null`), alongside a note that `blocked` is set by the abuse scanner.
+
+- Updated dependencies [1fe3c66]
+  - @senderkit/sdk@0.10.0
+
 ## 0.6.2
 
 ### Patch Changes

packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@senderkit/cli",
-  "version": "0.6.2",
+  "version": "0.6.3",
   "description": "SenderKit command-line interface and MCP server — send notifications and inspect templates/messages from your terminal or AI assistant.",
   "license": "MIT",
   "homepage": "https://github.com/senderkit/senderkit-sdk#readme",

packages/sdk/CHANGELOG.md

@@ -1,5 +1,23 @@
 # @senderkit/sdk
 
+## 0.10.0
+
+### Minor Changes
+
+- 1fe3c66: Add the `blocked` message status introduced by the outbound abuse scanner.
+
+  senderkit-app now runs outbound anti-phishing detection over email and SMS
+  content. A flagged send is halted and the message lands in a new terminal
+  `blocked` state with a human-readable `blockedReason`. This brings the SDK,
+  CLI, and MCP surface back in lockstep with the app's `messageStatusEnum`.
+  - **`MESSAGE_STATUSES`** now includes `blocked` (between `opted_out` and
+    `canceled`), mirroring the app enum. The `senderkit_messages_list.status`
+    MCP/CLI filter is a strict `z.enum(MESSAGE_STATUSES)`, so before this change
+    it rejected `status: "blocked"` as invalid input — callers can now filter for
+    blocked messages.
+  - **`Message.blockedReason`** is documented on the message type (optional
+    `string | null`), alongside a note that `blocked` is set by the abuse scanner.
+
 ## 0.9.0
 
 ### Minor Changes

packages/sdk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@senderkit/sdk",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "Official TypeScript SDK for SenderKit — notification infrastructure for modern SaaS apps.",
   "license": "MIT",
   "homepage": "https://github.com/senderkit/senderkit-sdk#readme",