release: version packages

[github-actions]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and publish to npm yourself or setup this action to publish automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to dev, this PR will be updated.

Releases

@proofoftech/breakwater@0.15.0

Minor Changes

• 36c60c8: Require @mastra/core 1.67.0 exactly (previously 1.53.0). The peer is exact, so every consumer must move to 1.67.0 as well; this is breaking for consumers pinned to 1.53.0. 1.67.0 bundles for Cloudflare Workers and Vite again — [BUG] @mastra/core 1.54+ breaks on Cloudflare Workers due to tsdown dynamic import rewrite mastra-ai/mastra#20638, the dynamic-import regression that held the pin at 1.53.0, closed upstream.

  @mastra/cloudflare-d1 moves from 1.1.1 to 1.3.2, whose own peer requires a core newer than 1.53.0. FlowSafe's @proofoftech/breakwater peer floor rises to >=0.15.0 <1.0.0 in step, that being the first Breakwater release built against the same core.

  The @mastra/core patch FlowSafe shipped under patches/ is retired: 1.67.0 carries both fixes upstream ([BUG] summarizeNotifications miscounts sources named after Object.prototype members (bySource is a plain {} read with inherited lookups) mastra-ai/mastra#23693, [BUG] deliveryPolicy.sources lookup resolves inherited Object.prototype members, so a source named "constructor" bypasses priorities and default (including discard) mastra-ai/mastra#23694). The patch file is gone from the published package, and so are the two refusals that required it — FlowSafe no longer refuses to construct a delivering notification dispatch tick, nor notification ingestion and dispatch requests, on an install whose core lacks the patch. Consequence for anyone running a core outside the declared peer without having applied the patch: a notification source named after an Object.prototype member is miscounted in the summary core renders, and its source delivery policy resolves the inherited member instead of the configured priority or default action. That configuration was unsupported before and remains so, but it now fails silently rather than loudly. Application roots that copied the patch into their own patches/ should drop it along with the patchedDependencies entry or postinstall script that applied it.

  createD1Storage({ domains }) composes the two storage domains 1.67.0 adds, workflowDefinitions and knowledge, through the same override seam as the other domains. @mastra/cloudflare-d1 backs neither, so each resolves undefined unless a host supplies one through that seam.

  The workspace lockfile behind this release was resolved once with pnpm's seven-day minimum-release-age gate overridden for that resolution only. Five newly resolved versions were younger than the gate at resolution on 2026-09-19: @mastra/core 1.67.0 and @mastra/schema-compat 1.3.10 (published 2026-09-15), which the workspace's standing @mastra/* exclude admits with the gate on, and posthog-node 5.52.4 (2026-09-15), @posthog/types 1.412.2 (2026-09-17) and @posthog/core 1.55.0 (2026-09-18), which the override alone admitted. None of the five declares a lifecycle script or ships a native component; all five carry npm provenance attestations (SLSA v1, published from GitHub Actions); and posthog-node, with @posthog/core and @posthog/types beneath it, is a hard dependency of @mastra/core that ships inside a bundled Worker.

  The private showcase and anchorage-agent-starter packages move to the same core.

@proofoftech/flowsafe@0.22.0

Minor Changes

• 36c60c8: Require @mastra/core 1.67.0 exactly (previously 1.53.0). The peer is exact, so every consumer must move to 1.67.0 as well; this is breaking for consumers pinned to 1.53.0. 1.67.0 bundles for Cloudflare Workers and Vite again — [BUG] @mastra/core 1.54+ breaks on Cloudflare Workers due to tsdown dynamic import rewrite mastra-ai/mastra#20638, the dynamic-import regression that held the pin at 1.53.0, closed upstream.

  @mastra/cloudflare-d1 moves from 1.1.1 to 1.3.2, whose own peer requires a core newer than 1.53.0. FlowSafe's @proofoftech/breakwater peer floor rises to >=0.15.0 <1.0.0 in step, that being the first Breakwater release built against the same core.

  The @mastra/core patch FlowSafe shipped under patches/ is retired: 1.67.0 carries both fixes upstream ([BUG] summarizeNotifications miscounts sources named after Object.prototype members (bySource is a plain {} read with inherited lookups) mastra-ai/mastra#23693, [BUG] deliveryPolicy.sources lookup resolves inherited Object.prototype members, so a source named "constructor" bypasses priorities and default (including discard) mastra-ai/mastra#23694). The patch file is gone from the published package, and so are the two refusals that required it — FlowSafe no longer refuses to construct a delivering notification dispatch tick, nor notification ingestion and dispatch requests, on an install whose core lacks the patch. Consequence for anyone running a core outside the declared peer without having applied the patch: a notification source named after an Object.prototype member is miscounted in the summary core renders, and its source delivery policy resolves the inherited member instead of the configured priority or default action. That configuration was unsupported before and remains so, but it now fails silently rather than loudly. Application roots that copied the patch into their own patches/ should drop it along with the patchedDependencies entry or postinstall script that applied it.

  createD1Storage({ domains }) composes the two storage domains 1.67.0 adds, workflowDefinitions and knowledge, through the same override seam as the other domains. @mastra/cloudflare-d1 backs neither, so each resolves undefined unless a host supplies one through that seam.

  The workspace lockfile behind this release was resolved once with pnpm's seven-day minimum-release-age gate overridden for that resolution only. Five newly resolved versions were younger than the gate at resolution on 2026-09-19: @mastra/core 1.67.0 and @mastra/schema-compat 1.3.10 (published 2026-09-15), which the workspace's standing @mastra/* exclude admits with the gate on, and posthog-node 5.52.4 (2026-09-15), @posthog/types 1.412.2 (2026-09-17) and @posthog/core 1.55.0 (2026-09-18), which the override alone admitted. None of the five declares a lifecycle script or ships a native component; all five carry npm provenance attestations (SLSA v1, published from GitHub Actions); and posthog-node, with @posthog/core and @posthog/types beneath it, is a hard dependency of @mastra/core that ships inside a bundled Worker.

  The private showcase and anchorage-agent-starter packages move to the same core.

@proofoftech/fleet-control@0.5.1

Patch Changes

• Updated dependencies [36c60c8]
  • @proofoftech/flowsafe@0.22.0

anchorage-agent-starter@0.0.18

Patch Changes

• 36c60c8: Require @mastra/core 1.67.0 exactly (previously 1.53.0). The peer is exact, so every consumer must move to 1.67.0 as well; this is breaking for consumers pinned to 1.53.0. 1.67.0 bundles for Cloudflare Workers and Vite again — [BUG] @mastra/core 1.54+ breaks on Cloudflare Workers due to tsdown dynamic import rewrite mastra-ai/mastra#20638, the dynamic-import regression that held the pin at 1.53.0, closed upstream.

  @mastra/cloudflare-d1 moves from 1.1.1 to 1.3.2, whose own peer requires a core newer than 1.53.0. FlowSafe's @proofoftech/breakwater peer floor rises to >=0.15.0 <1.0.0 in step, that being the first Breakwater release built against the same core.

  The @mastra/core patch FlowSafe shipped under patches/ is retired: 1.67.0 carries both fixes upstream ([BUG] summarizeNotifications miscounts sources named after Object.prototype members (bySource is a plain {} read with inherited lookups) mastra-ai/mastra#23693, [BUG] deliveryPolicy.sources lookup resolves inherited Object.prototype members, so a source named "constructor" bypasses priorities and default (including discard) mastra-ai/mastra#23694). The patch file is gone from the published package, and so are the two refusals that required it — FlowSafe no longer refuses to construct a delivering notification dispatch tick, nor notification ingestion and dispatch requests, on an install whose core lacks the patch. Consequence for anyone running a core outside the declared peer without having applied the patch: a notification source named after an Object.prototype member is miscounted in the summary core renders, and its source delivery policy resolves the inherited member instead of the configured priority or default action. That configuration was unsupported before and remains so, but it now fails silently rather than loudly. Application roots that copied the patch into their own patches/ should drop it along with the patchedDependencies entry or postinstall script that applied it.

  createD1Storage({ domains }) composes the two storage domains 1.67.0 adds, workflowDefinitions and knowledge, through the same override seam as the other domains. @mastra/cloudflare-d1 backs neither, so each resolves undefined unless a host supplies one through that seam.

  The workspace lockfile behind this release was resolved once with pnpm's seven-day minimum-release-age gate overridden for that resolution only. Five newly resolved versions were younger than the gate at resolution on 2026-09-19: @mastra/core 1.67.0 and @mastra/schema-compat 1.3.10 (published 2026-09-15), which the workspace's standing @mastra/* exclude admits with the gate on, and posthog-node 5.52.4 (2026-09-15), @posthog/types 1.412.2 (2026-09-17) and @posthog/core 1.55.0 (2026-09-18), which the override alone admitted. None of the five declares a lifecycle script or ships a native component; all five carry npm provenance attestations (SLSA v1, published from GitHub Actions); and posthog-node, with @posthog/core and @posthog/types beneath it, is a hard dependency of @mastra/core that ships inside a bundled Worker.

  The private showcase and anchorage-agent-starter packages move to the same core.

• Updated dependencies [36c60c8]

  • @proofoftech/breakwater@0.15.0
  • @proofoftech/flowsafe@0.22.0

showcase@0.0.24

Patch Changes

• 36c60c8: Require @mastra/core 1.67.0 exactly (previously 1.53.0). The peer is exact, so every consumer must move to 1.67.0 as well; this is breaking for consumers pinned to 1.53.0. 1.67.0 bundles for Cloudflare Workers and Vite again — [BUG] @mastra/core 1.54+ breaks on Cloudflare Workers due to tsdown dynamic import rewrite mastra-ai/mastra#20638, the dynamic-import regression that held the pin at 1.53.0, closed upstream.

  @mastra/cloudflare-d1 moves from 1.1.1 to 1.3.2, whose own peer requires a core newer than 1.53.0. FlowSafe's @proofoftech/breakwater peer floor rises to >=0.15.0 <1.0.0 in step, that being the first Breakwater release built against the same core.

  The @mastra/core patch FlowSafe shipped under patches/ is retired: 1.67.0 carries both fixes upstream ([BUG] summarizeNotifications miscounts sources named after Object.prototype members (bySource is a plain {} read with inherited lookups) mastra-ai/mastra#23693, [BUG] deliveryPolicy.sources lookup resolves inherited Object.prototype members, so a source named "constructor" bypasses priorities and default (including discard) mastra-ai/mastra#23694). The patch file is gone from the published package, and so are the two refusals that required it — FlowSafe no longer refuses to construct a delivering notification dispatch tick, nor notification ingestion and dispatch requests, on an install whose core lacks the patch. Consequence for anyone running a core outside the declared peer without having applied the patch: a notification source named after an Object.prototype member is miscounted in the summary core renders, and its source delivery policy resolves the inherited member instead of the configured priority or default action. That configuration was unsupported before and remains so, but it now fails silently rather than loudly. Application roots that copied the patch into their own patches/ should drop it along with the patchedDependencies entry or postinstall script that applied it.

  createD1Storage({ domains }) composes the two storage domains 1.67.0 adds, workflowDefinitions and knowledge, through the same override seam as the other domains. @mastra/cloudflare-d1 backs neither, so each resolves undefined unless a host supplies one through that seam.

  The workspace lockfile behind this release was resolved once with pnpm's seven-day minimum-release-age gate overridden for that resolution only. Five newly resolved versions were younger than the gate at resolution on 2026-09-19: @mastra/core 1.67.0 and @mastra/schema-compat 1.3.10 (published 2026-09-15), which the workspace's standing @mastra/* exclude admits with the gate on, and posthog-node 5.52.4 (2026-09-15), @posthog/types 1.412.2 (2026-09-17) and @posthog/core 1.55.0 (2026-09-18), which the override alone admitted. None of the five declares a lifecycle script or ships a native component; all five carry npm provenance attestations (SLSA v1, published from GitHub Actions); and posthog-node, with @posthog/core and @posthog/types beneath it, is a hard dependency of @mastra/core that ships inside a bundled Worker.

  The private showcase and anchorage-agent-starter packages move to the same core.

• Updated dependencies [36c60c8]

  • @proofoftech/breakwater@0.15.0
  • @proofoftech/flowsafe@0.22.0

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	anchorage-showcase-single-tenant	678a284	Sep 19 2026, 01:41 AM