chore(release): prepare v1.2.0

CHANGELOG.md

@@ -2,6 +2,23 @@
 
 All notable changes to this project will be documented in this file.
 
+## [1.2.0] - 2026-05-01
+
+Minor release of `@sunflower0305/claude-proxy`.
+
+### Changed
+
+- `.env` loading now uses Node.js built-in `.env` file support instead of the external `dotenv` package
+- minimum supported Node.js version is now 20.12
+- CORS is no longer enabled by default
+
+### Removed
+
+- removed runtime dependency on `dotenv`
+- removed unused `cors` and `@types/cors` dependencies
+
+Detailed release notes: [docs/releases/1.2.0.md](docs/releases/1.2.0.md)
+
 ## [1.1.3] - 2026-04-24
 
 Patch release of `@sunflower0305/claude-proxy`.

README.md

@@ -14,6 +14,8 @@ It currently supports `qwen`, `deepseek`, `glm`, `minimax`, and `kimi`.
 
 ## Install
 
+Requires Node.js 20.12 or newer.
+
 Run without installing:
 
 ```bash
@@ -29,7 +31,7 @@ claude-proxy
 
 ## Configure
 
-The proxy reads configuration from environment variables. You can export them in your shell or create a `.env` file in the directory where you run `claude-proxy`.
+The proxy reads configuration from environment variables. You can export them in your shell or create a `.env` file in the directory where you run `claude-proxy`; `.env` loading uses Node.js built-in `.env` file support.
 
 Example `.env`:
 

docs/releases/1.2.0.md

@@ -0,0 +1,49 @@
+# `@sunflower0305/claude-proxy` v1.2.0
+
+Minor release of `claude-proxy`, published as `@sunflower0305/claude-proxy`.
+
+## Highlights
+
+- `.env` loading now uses Node.js built-in `.env` file support
+- the external `dotenv` package is no longer required
+- default CORS middleware has been removed
+- the package now requires Node.js 20.12 or newer
+
+## Upgrade Notes
+
+If you run `claude-proxy` with a local `.env` file, keep running it from the directory that contains that file. Existing environment variables still take precedence over values loaded from `.env`.
+
+Browser clients that relied on permissive default CORS headers must now put CORS handling in front of the proxy explicitly.
+
+## Installation
+
+```bash
+npx @sunflower0305/claude-proxy
+```
+
+or:
+
+```bash
+npm install -g @sunflower0305/claude-proxy
+claude-proxy
+```
+
+## Verification Summary
+
+Local release gates to complete for `v1.2.0` before publication:
+
+- local TypeScript build completes successfully
+- local integration test suite passes
+- coverage generation completes successfully
+- `npm pack --dry-run` confirms the published artifact includes `dist/`, `README.md`, `CHANGELOG.md`, `LICENSE`, and `.env.example`
+
+Post-publish verification plan:
+
+- confirm the `CD` workflow runs successfully for tag `v1.2.0`
+- verify npm publication completes and the `latest` dist-tag points to `1.2.0`
+- confirm the GitHub Release `v1.2.0` is created from these release notes
+
+## Source
+
+- GitHub: <https://github.com/sunflower0305/claude-proxy>
+- npm: <https://www.npmjs.com/package/@sunflower0305/claude-proxy>

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sunflower0305/claude-proxy",
-  "version": "1.1.3",
+  "version": "1.2.0",
   "type": "module",
   "description": "A proxy that lets Claude Agent SDK use domestic Chinese LLMs (DeepSeek, Qwen, GLM, MiniMax) as backend",
   "license": "MIT",
@@ -23,7 +23,7 @@
     ".env.example"
   ],
   "engines": {
-    "node": ">=18"
+    "node": ">=20.12"
   },
   "publishConfig": {
     "access": "public"
@@ -55,20 +55,17 @@
     "prepack": "npm run build",
     "prepublishOnly": "npm run test:proxy-local",
     "test": "vitest run",
-    "test:coverage": "vitest run tests/integration/proxy-local.test.ts --coverage --coverage.reporter=lcov --coverage.reporter=text --pool threads",
+    "test:coverage": "vitest run tests/integration/proxy-local.test.ts --coverage --coverage.reporter=lcov --coverage.reporter=text --pool forks",
     "test:proxy-local": "vitest run tests/integration/proxy-local.test.ts",
     "test:provider-anthropic": "node --experimental-strip-types tests/integration/provider-anthropic.ts",
     "test:provider-cli-e2e": "node --experimental-strip-types tests/integration/provider-cli-e2e.ts",
     "report:provider-cli-e2e": "node --experimental-strip-types tests/integration/report-provider-cli-e2e.ts"
   },
   "dependencies": {
-    "cors": "^2.8.5",
-    "dotenv": "^16.4.5",
     "express": "^4.21.0"
   },
   "devDependencies": {
     "@vitest/coverage-v8": "^3.2.4",
-    "@types/cors": "^2.8.17",
     "@types/express": "^4.17.21",
     "@types/node": "^22.0.0",
     "tsx": "^4.19.0",

src/proxy.ts

@@ -10,13 +10,14 @@
  *   export ANTHROPIC_API_KEY=any-key-works
  */
 
-import "dotenv/config";
-import cors from "cors";
 import express from "express";
-import { realpathSync } from "node:fs";
+import { existsSync, realpathSync } from "node:fs";
+import { loadEnvFile } from "node:process";
 import { Readable } from "node:stream";
 import { fileURLToPath } from "node:url";
 
+if (existsSync(".env")) loadEnvFile(".env");
+
 const DEFAULT_ANTHROPIC_VERSION = "2023-06-01";
 const HOP_BY_HOP_RESPONSE_HEADERS = new Set([
   "connection",
@@ -401,7 +402,6 @@ export function createApp(): express.Express {
 
   const app = express();
 
-  app.use(cors());
   app.use(express.json({ limit: "50mb" }));
 
   app.get("/", (_req, res) => {

tests/integration/lib/anthropic-compat.ts

@@ -1,5 +1,3 @@
-import "dotenv/config";
-
 export type TestMode = "non-stream" | "stream";
 
 export interface AnthropicCompatibilityCase {

tests/integration/lib/providers.ts

@@ -1,4 +1,7 @@
-import "dotenv/config";
+import { existsSync } from "node:fs";
+import { loadEnvFile } from "node:process";
+
+if (existsSync(".env")) loadEnvFile(".env");
 
 export type ProviderKey = "deepseek" | "qwen" | "glm" | "minimax" | "kimi";
 

tests/integration/provider-cli-e2e.ts

@@ -1,4 +1,3 @@
-import "dotenv/config";
 import { mkdir, writeFile } from "node:fs/promises";
 import path from "node:path";
 import { spawn } from "node:child_process";