Repository navigation
Conversation
chore: back-merge main into dev after 1.2.2
Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.2.0 to 4.3.2. - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.2.0...4.3.2) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 4.3.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps and [brace-expansion](https://github.com/juliangruber/brace-expansion). These dependencies needed to be updated together. Updates `brace-expansion` from 1.1.15 to 1.1.21 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v1.1.15...v1.1.21) Updates `brace-expansion` from 2.1.1 to 2.1.7 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v1.1.15...v1.1.21) Updates `brace-expansion` from 5.0.6 to 5.0.12 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v1.1.15...v1.1.21) --- updated-dependencies: - dependency-name: brace-expansion dependency-version: 1.1.21 dependency-type: indirect - dependency-name: brace-expansion dependency-version: 2.1.7 dependency-type: indirect - dependency-name: brace-expansion dependency-version: 5.0.12 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.4 to 3.1.9. - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.4...v3.1.9) --- updated-dependencies: - dependency-name: fast-uri dependency-version: 3.1.9 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
…-4.3.2 ci: Bump js-yaml from 4.2.0 to 4.3.2
…7637e47fe ci: Bump brace-expansion
…i-3.1.9 ci: Bump fast-uri from 3.1.4 to 3.1.9
`obsidian` pins `moment` to exactly 2.29.4, so Dependabot's security update for alert #35 fails with "latest possible version ... is 2.29.4". Force the patched release with an npm `overrides` entry instead. `moment` is only consumed for the type declarations in obsidian.d.ts; src/ never imports it and esbuild never bundles it (Obsidian provides its own copy at runtime). Type-check and lint pass, and the production main.js / styles.css are byte-identical before and after. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The release docs already said to keep package.json's version in sync with manifest.json, but nothing checked it, and it stayed at 1.1.5 through the 1.2.0, 1.2.1 and 1.2.2 releases. Bump package.json / package-lock.json to 1.2.2 and make scripts/validate.mjs fail CI when either disagrees with manifest.version. List the package.json bump (`npm version <x.y.z> --no-git-tag-version`) as an explicit step in CONTRIBUTING.md, docs/DEVELOPMENT.md, CLAUDE.md and the release PR checklist. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- src/main.ts is ~1,850 lines now, not ~900. - dependabot.yml still described the plugin as "plain CommonJS with no build step", which predates the TypeScript + esbuild toolchain. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…-g3hv-75wg-m249) The globParts-amplification DoS is only fixed in minimatch 11.0.1, and no upstream release (not even eslint 10) accepts 11, so Dependabot's security update fails. Override minimatch to ^11.0.1 under the consumers that only use the named `Minimatch` / `minimatch` exports, which 11 keeps: eslint, @eslint/config-array, @eslint/eslintrc, @typescript-eslint/typescript-estree, eslint-plugin-n This replaces the copies that actually contain the vulnerable code (9.0.9, 10.2.5) and moves ESLint's own file/config matching to 11.0.3. Left alone on purpose: eslint-plugin-import / eslint-plugin-react (3.x) and eslint-plugin-json-schema-validator (8.x, pinned by eslint-plugin-obsidianmd) call the module itself or its default export. minimatch >= 10 exports a plain object, so forcing 11 there would crash them. 3.x predates the vulnerable preprocessing, and the json-schema-validator rules are not enabled for src/. A callable shim via a `file:` override was tried and dropped: npm 11 resolves `file:` overrides relative to each consumer, which produces broken links. Verification: - differential test, minimatch 3.1.5 vs 11.0.3, on the option sets ESLint and eslint-plugin-n pass: 3300 cases, only diffs are patterns containing `..` (11 normalizes them), which our config does not use - `eslint --print-config src/main.ts` is identical before and after, and the same files are linted - full CI gate passes; production main.js is unaffected (dev toolchain only) Rationale and removal criteria are documented in docs/DEVELOPMENT.md. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Dev-toolchain security maintenance (moment / minimatch overrides, lockfile bumps #43–#45) and the package.json version check. No behaviour change: the production main.js / styles.css are byte-identical to the 1.2.2 release assets. manifest.json, package.json / package-lock.json → 1.2.3; versions.json "1.2.3": "1.6.6"; CHANGELOG dated section. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
chore: patch moment/minimatch advisories, sync package.json version, refresh stale docs
chore: release 1.2.3
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release 1.2.3
Dev-toolchain security maintenance. No behaviour change: the built
main.js/styles.cssare byte-identical to the 1.2.2 release assets.Highlights
Security (dev toolchain only)
moment→^2.31.0via npmoverrides(GHSA-4p3w-j4w9-5jqw). Alert release: 1.2.1 #35 is now fixed.minimatch→^11.0.1under eslint,@eslint/config-array,@eslint/eslintrc,@typescript-eslint/typescript-estreeandeslint-plugin-n(GHSA-g3hv-75wg-m249). This replaces every copy that contains the vulnerable code.docs/DEVELOPMENT.md.js-yaml4.3.2,brace-expansion1.1.21 / 2.1.7 / 5.0.12,fast-uri3.1.9 (ci: Bump js-yaml from 4.2.0 to 4.3.2 #43, ci: Bump brace-expansion #44, ci: Bump fast-uri from 3.1.4 to 3.1.9 #45).Release hygiene (#46)
package.json/package-lock.jsoncarry the release version again. They had been stuck at 1.1.5 since 1.2.0.scripts/validate.mjsnow fails CI when they drift frommanifest.json.dependabot.ymlcomment.Pre-merge checklist
manifest.jsonversionis set to 1.2.3package.json/package-lock.jsonversionis 1.2.3versions.jsonhas"1.2.3": "1.6.6"(matchesmanifest.minAppVersion)CHANGELOG.mdhas a dated## [1.2.3] - 2026-11-02sectionnode --check main.jsandnode scripts/validate.mjspass locallyvalidate) is green on this PRAfter merge (automatic)
On merge into
main, the Release workflow:1.2.3frommanifest.json,1.2.3tag,main.js,manifest.jsonandstyles.css(provenance-attested).Maintainer follow-up:
mainintodev.🤖 Generated with Claude Code