Repository navigation
chore: version packages - #49
Merged
Merged
Conversation
jevvy-release
Bot
force-pushed
the
changeset-release/main
branch
6 times, most recently
from
October 15, 2026 01:52
936408b to
43c232a
Compare
PanAchy
added a commit
that referenced
this pull request
Oct 15, 2026
## Summary Fix both open dependency advisories without changing the OpenCode/Effect pins or removing the UI integration. - Keep Dependabot's `shell-quote` update from 1.10.0 to 1.12.0 for [GHSA-pqg4-j6r4-53mv](GHSA-pqg4-j6r4-53mv). - Resolve Solid's `seroval` from 1.5.6 to 1.6.9 for [GHSA-p6vx-979v-rg4c](GHSA-p6vx-979v-rg4c), using an exact override scoped to `solid-js@1.9.12`. - Add credential-free behavior tests for both advisory cases, ordinary Seroval Promise/cyclic-data round trips, and Solid async rendering/hydration with the patched serializer. The override is needed because Solid 1.9.12 requires `seroval ~1.5.0`, excluding every patched version. OpenTUI pins Solid exactly to 1.9.12, including in its latest release, so bumping Solid alone would violate that peer contract. The scoped override leaves Solid, OpenTUI, OpenCode 2.0.27, Effect 4.0.1, and every other dependency unchanged. This fixes this repository's dependency resolution. Root npm overrides do not propagate into consumers' separate OpenCode installations. Jevvy's permission code does not invoke Seroval's affected `fromJSON()` path, and neither vulnerable package is bundled into its hook. This PR does not claim to patch every host's UI dependency graph. ## Verification - The thenable regression fails on Seroval 1.5.6 because the callback is invoked, and passes on 1.6.9 because deserialization rejects it without invocation. No shell payload or remote request is executed. - All four focused behavior/compatibility tests pass. - Full `npm run check` passes: typecheck, lint, 378 tests, and build. No lint suppressions or weakened rules. - `npm audit --json` reports zero vulnerabilities in this PR's installed dependency tree, including zero critical findings. - `npm ls` confirms only patched `shell-quote@1.12.0` and `seroval@1.6.9`, with the existing Seroval plugins deduplicating to 1.6.9. - Independent lockfile comparison confirms that only the shell-quote and seroval package entries differ from main. All Effect/OpenCode versions are unchanged. - `changeset status` and `git diff --check` pass. No consumer package manifest, source API, question, threshold, model, or release version changes. - Sequential `npm run smoke` passed: packed package and all eleven setup scenarios, OpenCode 2.0.27 real shell review, Claude host loading, and native controls. These smokes made no real provider calls. - Repacked public tarball is byte-identical to the previously E2E-verified candidate: SHA-256 `ec219b9bbefee65f8e8d7845bb379872f2d066c1330ff71f80186fa7c8b84058`, 602319 bytes. This correction changes the private repository dependency graph, not the shipped runtime artifact. - GitHub CI run `38668620667` passed on `9f60366`: Check, both host smokes, and all six Linux/Windows/macOS x64/arm64 package jobs. The second event-triggered run is tracked separately. ## Release scope This is private development/optional-UI dependency maintenance, so no product version changeset is added. Release PR #49 remains untouched and unmerged. The user has more work planned before another release. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: PanAchy <19510452+PanAchy@users.noreply.github.com>
jevvy-release
Bot
force-pushed
the
changeset-release/main
branch
from
October 15, 2026 02:12
43c232a to
9fa82a3
Compare
11 tasks done
jevvy-release
Bot
force-pushed
the
changeset-release/main
branch
2 times, most recently
from
October 18, 2026 04:33
7cd140a to
1782779
Compare
jevvy-release
Bot
force-pushed
the
changeset-release/main
branch
from
October 18, 2026 04:38
027d14e to
e9b3715
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release
@jevvy/permissions@0.7.0. Merging this PR publishes to npm.Breaking changes
cf41ba2- Zen now defaults to paidjev-1.13. Setproviders.zen.modelto"jev-1.13-free"to use the limited-time free route. Paid Zen does not inherit the free route's calibration attribution.Configuration
#61
cf41ba2- Choose a model withproviders.<provider>.modelfor Zen, TypeSafe, OpenRouter, or Vercel. Jevvy Permissions sends the exact identifier without fallback and preserves it during setup. Unverified models can use shipped questions without inheriting calibration attribution.#60
3312d21- Setpermissions.timeoutMsto change the provider timeout in either harness. The default remains 5000 ms. Host deadlines may end reviews sooner; timeout leaves host permission handling unchanged.#40
74b785e- Use Jevvy Permissions consistently in setup and help. Clarify that OpenCode 2.0.27 is required only for the OpenCode integration, starting in 0.6.0.#41
4a275d7- Explain permission handling with plain-language documentation and readable light and dark diagrams, including the npm README.Reliability
#45
8bb92f5- Improve setup with Unicode-safe layouts, masked credentials, clean cancellation, and support for Windows.cmdharness installers.#46
06b03c5- Check selected harness CLIs before saving setup. Warn about unsupported or unrecognized OpenCode versions and require an explicit override to continue.#44
c9f3f81- Release Claude Code settings inspection on timeout or interruption while preserving host asks and linked-worktree settings.#43
4d08c2e- Load global configuration through Effect filesystem services while preserving credential-file permissions and setup diagnostics.Fixes
#59
ad50af2- Send Zen API keys as Bearer tokens so paid-model requests authenticate correctly.#42
7143594- Execute provider judgments during calibration. Preserve interrupted runs, record invalid responses as errors, and refuse to overwrite existing calibration artifacts.