Search code, repositories, users, issues, pull requests...

9.0.0-alpha.3 (2026-06-02)

Bug Fixes

android: show only the requested system bar (#8480) (4c6c321)
cli: revert live reload config on failure (#8485) (1d031a4)
SystemBars: make safe-area-inset-x available on API <= 34 (#8424) (e456de0)
SystemBars: respect insetsHandling disable (#8481) (d4ad7ff)

Features

add method getDouble to plugin config ([#7638](`Cordova code-push Dependency install loop ionic-team/capacitor#763...

[View full release notes]

Released by jcesarmobile on 6/2/2026

`8.4.0`

8.4.0 (2026-06-02)

Bug Fixes

android: show only the requested system bar (#8480) (4c6c321)
cli: revert live reload config on failure (#8485) (1d031a4)
SystemBars: make safe-area-inset-x available on API <= 34 (#8424) (e456de0)
SystemBars: respect insetsHandling disable (#8481) (d4ad7ff)

Features

add method getDouble to plugin config (#7638) ([93c72de](https://...

[View full release notes]

Released by jcesarmobile on 6/2/2026

`9.0.0-alpha.2`

9.0.0-alpha.2 (2026-05-12)

Note: Version bump only for package capacitor

Released by jcesarmobile on 5/12/2026

ionic-team/capacitor (@capacitor/cli)

8.3.0 -> 8.4.0

Capacitor: Cross-platform apps with JavaScript and the web

ionic-team/capacitor (@capacitor/core)

8.3.0 -> 8.4.0

`9.0.0-alpha.3`

9.0.0-alpha.3 (2026-06-02)

Bug Fixes

android: show only the requested system bar (#8480) (4c6c321)
cli: revert live reload config on failure (#8485) (1d031a4)
SystemBars: make safe-area-inset-x available on API <= 34 (#8424) (e456de0)
SystemBars: respect insetsHandling disable (#8481) (d4ad7ff)

Features

add method getDouble to plugin config ([#7638](`Cordova code-push Dependency install loop ionic-team/capacitor#763...

[View full release notes]

Released by jcesarmobile on 6/2/2026

`8.4.0`

8.4.0 (2026-06-02)

Bug Fixes

android: show only the requested system bar (#8480) (4c6c321)
cli: revert live reload config on failure (#8485) (1d031a4)
SystemBars: make safe-area-inset-x available on API <= 34 (#8424) (e456de0)
SystemBars: respect insetsHandling disable (#8481) (d4ad7ff)

Features

add method getDouble to plugin config (#7638) ([93c72de](https://...

[View full release notes]

Released by jcesarmobile on 6/2/2026

`9.0.0-alpha.2`

9.0.0-alpha.2 (2026-05-12)

Note: Version bump only for package capacitor

Released by jcesarmobile on 5/12/2026

ionic-team/capacitor (@capacitor/ios)

8.3.0 -> 8.4.0

`9.0.0-alpha.3`

9.0.0-alpha.3 (2026-06-02)

Bug Fixes

android: show only the requested system bar (#8480) (4c6c321)
cli: revert live reload config on failure (#8485) (1d031a4)
SystemBars: make safe-area-inset-x available on API <= 34 (#8424) (e456de0)
SystemBars: respect insetsHandling disable (#8481) (d4ad7ff)

Features

add method getDouble to plugin config ([#7638](`Cordova code-push Dependency install loop ionic-team/capacitor#763...

[View full release notes]

Released by jcesarmobile on 6/2/2026

`8.4.0`

8.4.0 (2026-06-02)

Bug Fixes

android: show only the requested system bar (#8480) (4c6c321)
cli: revert live reload config on failure (#8485) (1d031a4)
SystemBars: make safe-area-inset-x available on API <= 34 (#8424) (e456de0)
SystemBars: respect insetsHandling disable (#8481) (d4ad7ff)

Features

add method getDouble to plugin config (#7638) ([93c72de](https://...

[View full release notes]

Released by jcesarmobile on 6/2/2026

`9.0.0-alpha.2`

9.0.0-alpha.2 (2026-05-12)

Note: Version bump only for package capacitor

Released by jcesarmobile on 5/12/2026

DefinitelyTyped/DefinitelyTyped (@types/vscode)

1.110.0 -> 1.120.0

TypeScript definitions for vscode

Microsoft/vsce (@vscode/vsce)

3.7.2-12 -> 3.9.2

`v3.9.2`

Changes:

#1283: fix: skip APIScan
#1282: chore: bump CI to Node 22 and fix build
#1279: Bump the uuid test fixture version to 100.0.0
#1278: Bump tmp from 0.2.4 to 0.2.6
#1277: Bump qs from 6.14.2 to 6.15.2
#1276: Bump uuid and azure/msal-node
#1274: Run npm audit fix
#1272: Bump fast-uri from 3.0.6 to 3.1.2
#1267: Bump minimatch from 10.2.2 to 10.2.3
#1247: Update minimatch dependency to v10

This list of changes was auto generated.

Released by joaomoreno on 6/3/2026

`v3.9.2-4`

Changes:

#1283: fix: skip APIScan
#1282: chore: bump CI to Node 22 and fix build
#1279: Bump the uuid test fixture version to 100.0.0
#1278: Bump tmp from 0.2.4 to 0.2.6
#1277: Bump qs from 6.14.2 to 6.15.2
#1276: Bump uuid and azure/msal-node

This list of changes was auto generated.

Released by joaomoreno on 6/3/2026

`v3.9.2-3`

Changes:

#1274: Run npm audit fix

This list of changes was auto generated.

Released by joaomoreno on 5/14/2026

cure53/DOMPurify (dompurify)

3.3.3 -> 3.4.8

`3.4.8`

Cleaned up the repository root, renamed some and removed unneeded files
Fixed an issue with handling of Trusted Types policies, thanks fulstadev
Fixed the node iterator for better template scrubbing, thanks IamLeandrooooo
Included formerly missing LICENSE-MPL in published npm package, thanks asamuzaK
Bumped several dependencies where possible

Released by cure53 on 6/3/2026

`3.4.7`

Hardened the handling of Shadow Roots when using IN_PLACE, thanks GameZoneHacker
Removed a problem leading to permanent hook pollution, thanks offset
Refactored the test suite and expanded test coverage significantly

Released by cure53 on 5/27/2026

`3.4.6`

Fixed several issues with DOM Clobbering in IN_PLACE mode, thanks offset & Bankde
Hardened the checks for cross-realm IN_PLACE and Shadow DOM sanitization, thanks offset & Bankde
Added more test coverage for IN_PLACE and general DOM Clobbering attacks
Bumped several dependencies where possible

Released by cure53 on 5/26/2026

capricorn86/happy-dom (happy-dom)

20.8.9 -> 20.10.2

`v20.10.2`

👷‍♂️ Patch fixes

Updates external dependencies - By capricorn86 in task #2163

Released by github-actions[bot] on 6/6/2026

`v20.10.0`

🎨 Features

Adds support for setting a canvas adapter for handling the canvas rendering using the browser setting canvasAdapter - By RAprogramm and capricorn86 in task #241
Adds new package [happy-dom/node-canvas-adapter](https://github.com/capricorn86/happy-dom/tree/master/packages/%40happy-dom/node-canvas-adapter) - By RAprogramm and capricorn86 in task #241
- [happy-dom/node-canvas-adapter](https://github.com/capricorn86/happy-dom/tree/master/packages/%40happy-dom/node-canvas-adapter) is a pluggable canvas adapter for Happy DOM using node-canvas.
Adds support for loading image files when enabling the browser setting [enableImageFileLo...

[View full release notes]

Released by capricorn86 on 6/3/2026

`v20.9.0`

🎨 Features

Adds support for event listener properties on Window (e.g. Window.onkeydown) - By capricorn86 in task #2131

Released by capricorn86 on 4/13/2026

kkomelin/isomorphic-dompurify (isomorphic-dompurify)

3.7.1 -> 3.16.0

Makes it possible to use DOMPurify on server and client in the same way.

nodeca/js-yaml (js-yaml)

4.1.1 -> 4.2.0

YAML 1.2 parser and serializer

jsdom/jsdom (jsdom)

29.0.1 -> 29.1.1

`v29.1.1`

Fixed 'border-radius' computed style serialization. (asamuzaK)
Fixed computed style computation when using 'background-origin' and 'background-clip' CSS properties. (asamuzaK)
Significantly optimized initial calls to getComputedStyle(), before the cache warms up. (asamuzaK)

Released by domenic on 4/30/2026

`v29.1.0`

Added basic support for the ratio CSS type. (asamuzaK)
Fixed getComputedStyle() sometimes returning outdated results after CSS was modified. (asamuzaK)

Released by domenic on 4/27/2026

`v29.0.2`

Significantly improved and sped up getComputedStyle(). Computed value rules are now applied across a broader set of properties, and include fixes related to inheritance, defaulting keywords, custom properties, and color-related values such as currentcolor and system colors. (asamuzaK)
Fixed CSS 'background' and 'border' shorthand parsing. (asamuzaK)

Released by domenic on 4/7/2026

harttle/liquidjs (liquidjs)

10.25.2 -> 10.27.0

`v10.27.0`

10.27.0 (2026-05-15)

Features

context: null-prototype scope frames via createScope (#899) (47d3f1b)

Released by github-actions[bot] on 5/15/2026

`v10.26.0`

10.26.0 (2026-05-14)

Bug Fixes

date: cap strftime widths and account padding in memoryLimit (#895) (3129d46)
enforce renderLimit for empty renderTemplates calls (#894) (5b9c346)
propagate ownPropertyOnly into Context.spawn() for {% render %} (#893) (dbbf628)
security: block Object.prototype filter/tag lookups (RCE) (#897) (457fae0)
strip html newline tags (#892) ([26ea285](https://github.com/harttle/liquidjs/commit/...

[View full release notes]

Released by github-actions[bot] on 5/14/2026

`v10.25.7`

10.25.7 (2026-04-23)

Bug Fixes

filters: support Buffer input in base64_encode to prevent binary data corruption (#881) (0ee6dbb)

Released by github-actions[bot] on 4/23/2026

markdown-it/markdown-it (markdown-it)

14.1.1 -> 14.2.0

Markdown-it - modern pluggable markdown parser.

Microsoft/vscode-languageserver-node (vscode-languageserver-types)

3.17.5 -> 3.18.0

`release/types/3.18.0`

Changes:

Feature Requests:

#1691: Use NoInfer for better typing
#1692: setImmediate Implementation in browser RAL for json-rpc is not ideal.
#1698: RenameParams does not reference TextDocumentPositionParams interface in the JSON metamodel

Bugs:

#752: Edits are applied twice
#1717: Client requests textDocument/diagnostics before textDocument/didOpen
#1693: Output channel leak when stopping LanguageClient
#1581: Client error 'Failed to determine file type' after undoing rename with Cmd+Z
#1548: Extra true in the output log when a language server disconnects

See More

Others:

#1785: Allow returning null in SemanticTokensFeatureShape.on handler
#1784: SemanticTokensFeatureShape.on handler does not allow returning null
#1780: Add getMessageString function to Diagnostic namespace
#1779: Add 3.17 version check method for Diagnostic
#1778: Merge next release into main
#1777: U...

[View full release notes]

Released by joaomoreno on 6/3/2026

`release/server/10.0.0`

Released by joaomoreno on 6/3/2026

`release/protocol/3.18.0`

Released by joaomoreno on 6/3/2026

websockets/ws (ws)

8.20.0 -> 8.21.0

`8.21.0`

Features

Introduced the maxBufferedChunks and maxFragments options (2b2abd45).

Bug fixes

Fixed a remote memory exhaustion DoS vulnerability (2b2abd45).

A high volume of tiny fragments and data chunks could be sent by a peer, using
modest network traffic, to crash a ws server or client due to OOM.

import { WebSocket, WebSocketServer } from 'ws';

const wss = new WebSocketServer({ port: 0 }, function () {
  const data = Buffer.alloc(1);
  const options = { fin: false };
  const { port } = wss.address();
  const ws = new WebSocket(`ws://localhost:${port}`);

  ws.on('open', function () {
    (function send() {
      ws.send(data, options, function (err) {
        if (err) return;
        send();
      });
    })();
  });

  ws.on('error', console.error);
  ws.on('close', function (code, reason) {
    console.log(`client close - code: ${code} reason: ${reason.toString()}`);
  });
});

wss.on('connection', function (ws) {
  ws.on('error', console.error);
  ws.on('c...

*[View full release notes]*

*Released by [lpinca](https://github.com/lpinca) on 5/22/2026*

### [`8.20.1`](https://github.com/websockets/ws/releases/tag/8.20.1)

[Compare Source](https://github.com/websockets/ws/compare/v8.20.0...v8.21.0)

# Bug fixes

- Fixed an uninitialized memory disclosure issue in `websocket.close()`
  (c0327ec1).

Providing a `TypedArray` (e.g. `Float32Array`) as the `reason` argument for
`websocket.close()`, rather than the supported string or `Buffer` types, caused
uninitialized memory to be disclosed to the remote peer.

```js
import { deepStrictEqual } from 'node:assert';
import { WebSocket, WebSocketServer } from 'ws';

const wss = new WebSocketServer(
  { port: 0, skipUTF8Validation: true },
  function () {
    const { port } = wss.address();
    const ws = new WebSocket(`ws://localhost:${port}`, {
      skipUTF8Validation: true
    });

    ws.on('close', function (code, reason) {
      deepStrictEqual(reason, Buffer.alloc(80));
    });
  }
);

wss.on('connection', function (ws) {
  ws.close(1000, new Float32Array(20));
});

The issue was privately reported by Nikita Skovoroda.

Released by lpinca on 5/12/2026

11ty/eleventy (@11ty/eleventy)

3.1.5 -> 3.1.6

`v3.1.6`

Fixes Node 26 module.register deprecation warning shown in console #4283 (fixed in v4 alphas in #4271)
Minor dependency upgrades for npm audit fixes
- liquidjs upgrade from 1.25.0 to 1.27.0
- markdown-it upgrade from 14.1.1 to 14.2.0
Adds Node 26 to CI for v3 branch
Opt out of package manager cache for GitHub Actions CI release workflow (hardening security)

Milestone: https://github.com/11ty/eleventy/milestone/52?closed=1
Full Changelog: 11ty/eleventy@v3.1.5...v3.1.6

Released by zachleat on 6/2/2026

`v4.0.0-alpha.7`

Installation: npm install @11ty/eleventy@canary --save-exact
v4.0 Milestone: https://github.com/11ty/eleventy/milestone/46?closed=1
Commit log (from last canary): 11ty/eleventy@v4.0.0-alpha.6...v4.0.0-alpha.7

Fairi warning: this may be one of the last canary releases before you see some names start to change to Build Awesome.

What’s New?

Enables Node’s compile cache by default (opt-out available) #3499
Update error messaging around require(esm) Node versions 2018d43351d4bf20e2ce1907ec6fe02d229988eb
<meta> elements need closing slash when using HTML Transformer plugins (workaround for garbage parsers) #4200
Very experimental support for zero-config TypeScript (type stripping) support for Configuration Files, Data Files, Template files, Dependency mapping (when using --watch or --serve) on Node 22.6+ and newer #4194 #4195
Show configuration file in use on console output #3654
Fre...

[View full release notes]

Released by zachleat on 3/20/2026

`v4.0.0-alpha.6`

Installation: npm install @11ty/eleventy@canary --save-exact
v4.0 Milestone: https://github.com/11ty/eleventy/milestone/46?closed=1
Commit log (from last canary): 11ty/eleventy@v4.0.0-alpha.5...v4.0.0-alpha.6

Bug Fixes

Breaking (very low-risk): Fixes #2766. Changes how boolean attributes are rendered in the HTML Base plugin (and other plugins using the HTML Transformer API). e.g. <input disabled> now outputs as <input disabled> instead of <input disabled="">
Fixes #4188 bug with setLiquidOptions addding global data by paulrobertlloyd in 11ty/eleventy#4189
Fixes #4187 canary bug with CDATA wrapper on Markdown files
Fixes #4191 error with Eleventy layout resolution without file extensions (when key conflicted with a directory name in the includes or layouts folders)
Fixes #1645 issue with JavaScript 11ty.js templates that assign data or render callbacks using [Public cl...

[View full release notes]

Released by zachleat on 12/11/2025

ionic-team/capacitor-keyboard (@capacitor/keyboard)

8.0.2 -> 8.0.3

`v8.0.3`

8.0.3 (2026-04-10)

Bug Fixes

android: fixing Keyboard interaction with SystemBars (#62) (4afd89b)

This release is also available on:

[npm package (latest dist-tag)](https://www.npmjs.com/package/@capacitor/keyboard/v/8.0.3)

Released by capacitor-bot on 4/10/2026

cwcss/crosswind (@cwcss/crosswind)

0.2.0 -> 0.2.4

`v0.2.4`

Compare changes

🚀 Features

rules: table display family, flow-root/list-item/contents, arbitrary accent/caret (f31d55c)

🧹 Chores

release v0.2.4 (09382bd)

Contributors

Chris chrisbreuer93@gmail.com

Released by github-actions[bot] on 5/1/2026

`v0.2.3`

Compare changes

🧹 Chores

release v0.2.3 (0af1adb)
split and minify dist (23aef98)

Contributors

Chris chrisbreuer93@gmail.com

Released by github-actions[bot] on 5/1/2026

`v0.2.2`

Compare changes

🐛 Bug Fixes

build: emit dist/index.js + dist/cli.js to match exports/bin paths (1544b47)

🧹 Chores

release v0.2.2 (a0ceda7)

Contributors

Chris chrisbreuer93@gmail.com

Released by github-actions[bot] on 5/1/2026

iconify/icon-sets (@iconify/json)

2.2.463 -> 2.2.484

Hundreds of open source icon sets in IconifyJSON format

stacksjs/clapp (@stacksjs/clapp)

0.2.0 -> 0.2.10

`v0.2.10`

Released by github-actions[bot] on 5/14/2026

`v0.2.9`

Released by github-actions[bot] on 5/11/2026

`v0.2.8`