Skip to content

chore: release main - #9

Merged
lukeocodes merged 1 commit into
mainfrom
release-please--branches--main
Mar 27, 2026
Merged

chore: release main#9
lukeocodes merged 1 commit into
mainfrom
release-please--branches--main

Conversation

@github-actions

@github-actions github-actions Bot commented Mar 25, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🤖 I have created a release beep boop

0.2.4

0.2.4 (2026-03-25)

Features

  • skills: fetch latest skills from deepgram/skills on every install (b498311)
  • skills: interactive tool selection for skills setup (382b7a0)

Bug Fixes

  • mcp: update default base URL to api.dx.deepgram.com (c514545)
deepctl-core: 0.2.3

0.2.3 (2026-03-25)

Features

  • skills: fetch latest skills from deepgram/skills on every install (b498311)
deepctl-cmd-login: 0.1.13

0.1.13 (2026-03-25)

Features

  • skills: fetch latest skills from deepgram/skills on every install (b498311)
  • skills: interactive tool selection for skills setup (382b7a0)
deepctl-cmd-mcp: 0.1.12

0.1.12 (2026-03-25)

Bug Fixes

  • mcp: update default base URL to api.dx.deepgram.com (c514545)
deepctl-cmd-skills: 0.0.4

0.0.4 (2026-03-25)

Features

  • skills: fetch latest skills from deepgram/skills on every install (b498311)
  • skills: interactive tool selection for skills setup (382b7a0)

This PR was generated with Release Please. See documentation.

@github-actions
github-actions Bot requested a review from lukeocodes as a code owner March 25, 2026 20:17
@github-actions
github-actions Bot force-pushed the release-please--branches--main branch from de507e0 to 42607f0 Compare March 25, 2026 23:45
@lukeocodes
lukeocodes merged commit 4a38452 into main Mar 27, 2026
@lukeocodes
lukeocodes deleted the release-please--branches--main branch March 27, 2026 18:03
@github-actions

github-actions Bot commented Mar 27, 2026

Copy link
Copy Markdown
Contributor Author

🤖 Created releases:

🌻

GregHolmes added a commit that referenced this pull request Sep 23, 2026
@GregHolmes
chore(deps): bump svgo from 4.0.2 to 4.1.0 in /web in the npm_and_yar…
8a4a252 
…n group across 1 directory (#109)

Bumps the npm_and_yarn group with 1 update in the /web directory:
[svgo](https://github.com/svg/svgo).

Updates `svgo` from 4.0.2 to 4.1.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/svg/svgo/releases">svgo's
releases</a>.</em></p>
<blockquote>
<h2>v4.1.0</h2>
<p>This minor release upgrades the SAX parser and introduces stricter
XML validation. It also includes important security hardening for
<code>removeScripts</code>, dependency updates, and improvements to the
test and regression infrastructure.</p>
<h3>Support SVGO</h3>
<p>If SVGO is valuable to you or your organization, please consider <a
href="https://opencollective.com/svgo">supporting the project on
OpenCollective</a>. Your sponsorship helps fund ongoing maintenance and
security work.</p>
<h3>Stricter XML validation</h3>
<p>SVGO now uses <a
href="https://www.npmjs.com/package/sax"><code>sax</code> 1.6.1</a>,
upgraded from 1.5.0 (<a
href="https://redirect.github.com/svg/svgo/pull/2257">#2257</a>).</p>
<p>The new parser version validates numeric character references against
the ranges permitted by XML. Invalid references are now rejected in both
text and attributes, including:</p>
<ul>
<li>disallowed control characters such as
<code>&amp;[#1](https://github.com/svg/svgo/issues/1);</code>,
<code>&amp;#xB;</code>, and <code>&amp;#x1F;</code>;</li>
<li>UTF-16 surrogate code points such as <code>&amp;#xD800;</code>;</li>
<li>invalid XML code points such as <code>&amp;#xFFFF;</code>.</li>
</ul>
<p>Valid boundary values—including <code>U+0020</code>,
<code>U+D7FF</code>, <code>U+E000</code>, <code>U+FFFD</code>, and
characters through <code>U+10FFFF</code>—remain supported.</p>
<p>Parser failures are consistently exposed as
<code>SvgoParserError</code> errors with an <code>Invalid character
entity</code> reason.</p>
<p>This is an intentional behavior change: malformed SVGs that were
previously accepted may now produce a parser error, while valid XML
documents are unaffected.</p>
<h3>Security</h3>
<p>The <a
href="https://svgo.dev/docs/plugins/removeScripts/"><code>removeScripts</code></a>
plugin has been hardened against several script-execution bypasses:</p>
<ul>
<li>Filters executable <code>data:</code> URLs containing HTML, XHTML,
or SVG documents while preserving inert data such as PNG images, and
filters legacy <code>vbscript:</code> URLs (<a
href="https://redirect.github.com/svg/svgo/pull/2263">#2263</a>).</li>
<li>Sanitizes content inside SVG <code>&lt;foreignObject&gt;</code>
elements by removing HTML event-handler attributes, <code>srcdoc</code>,
and executable URLs from <code>action</code>, <code>data</code>,
<code>formaction</code>, <code>href</code>, and <code>src</code>, while
preserving non-executable HTML and visual content (<a
href="https://redirect.github.com/svg/svgo/pull/2264">#2264</a>).</li>
<li>Recognizes namespace-prefixed SVG <code>&lt;a&gt;</code> elements
and removes ASCII tabs and newlines before checking URL schemes,
preventing values such as
<code>java&amp;[#9](https://github.com/svg/svgo/issues/9);script:</code>
from bypassing detection while preserving elements in unrelated custom
namespaces (<a
href="https://redirect.github.com/svg/svgo/pull/2268">#2268</a>).</li>
</ul>
<p>These changes address:</p>
<ul>
<li><a
href="https://github.com/svg/svgo/security/advisories/GHSA-4vpr-x523-8j87">GHSA-4vpr-x523-8j87</a></li>
<li><a
href="https://github.com/svg/svgo/security/advisories/GHSA-w27v-7q3p-w38r">GHSA-w27v-7q3p-w38r</a></li>
</ul>
<h3>Dependencies</h3>
<ul>
<li>Upgraded <code>css-select</code> to v6 and <code>css-what</code> to
v7, and updated SVGO's custom selector adapter for
<code>css-select</code> v6 (<a
href="https://redirect.github.com/svg/svgo/pull/2244">#2244</a>).</li>
</ul>
<h3>Project maintenance</h3>
<p><a href="https://github.com/TrySound"><code>@​TrySound</code></a> is
back as an active SVGO maintainer.</p>
<p>Many thanks to <a
href="https://github.com/KTibow"><code>@​KTibow</code></a>, <a
href="https://github.com/SethFalco"><code>@​SethFalco</code></a>, and <a
href="https://github.com/XhmikosR"><code>@​XhmikosR</code></a> for
maintaining and improving SVGO over the past several years.</p>
<p><strong>Full Changelog:</strong> <a
href="https://github.com/svg/svgo/compare/v4.0.2...v4.1.0">https://github.com/svg/svgo/compare/v4.0.2...v4.1.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/svg/svgo/commit/5765cbe4e0a930dca648c6b81d335b1522cd7375"><code>5765cbe</code></a>
chore: prepare v4.1.0 release (<a
href="https://redirect.github.com/svg/svgo/issues/2275">#2275</a>)</li>
<li><a
href="https://github.com/svg/svgo/commit/3db3ef33e409a0bc0fdaf255e46c908b00e93bc2"><code>3db3ef3</code></a>
fix(removeScripts): handle anchor URL bypasses (<a
href="https://redirect.github.com/svg/svgo/issues/2268">#2268</a>)</li>
<li><a
href="https://github.com/svg/svgo/commit/4e9b9aed2a4607cf28025871151421d5bfe86484"><code>4e9b9ae</code></a>
chore: cache regression screenshots (<a
href="https://redirect.github.com/svg/svgo/issues/2267">#2267</a>)</li>
<li><a
href="https://github.com/svg/svgo/commit/d55270ce17b99ebfe16e4fad028bd162187205a1"><code>d55270c</code></a>
chore(regression): migrate comparison workers to Tinypool (<a
href="https://redirect.github.com/svg/svgo/issues/2266">#2266</a>)</li>
<li><a
href="https://github.com/svg/svgo/commit/fd51e474a300417d9361d9302d596b1763146327"><code>fd51e47</code></a>
fix(removeScripts): sanitize foreignObject content (<a
href="https://redirect.github.com/svg/svgo/issues/2264">#2264</a>)</li>
<li><a
href="https://github.com/svg/svgo/commit/dcaf957c6eb34832844de11ef2792e3e0e8db5dd"><code>dcaf957</code></a>
chore: optimize fixtures in a bounded worker pool (<a
href="https://redirect.github.com/svg/svgo/issues/2265">#2265</a>)</li>
<li><a
href="https://github.com/svg/svgo/commit/a3542937d9c85debab04b1ff75207768caf8a058"><code>a354293</code></a>
fix(removeScripts): filter executable data URLs (<a
href="https://redirect.github.com/svg/svgo/issues/2263">#2263</a>)</li>
<li><a
href="https://github.com/svg/svgo/commit/4e0d2ac5e7abd5f12d650d3e4b4d2500d4944cc5"><code>4e0d2ac</code></a>
ci(typecheck): return typechecking on CI</li>
<li><a
href="https://github.com/svg/svgo/commit/0b97fedd00a3001f1da616f61578c2c12e6cde1f"><code>0b97fed</code></a>
test(typescript): drop tsd for vitest type testing API</li>
<li><a
href="https://github.com/svg/svgo/commit/f6e8ae1afb012c2b47675622728d76b9bfd734f5"><code>f6e8ae1</code></a>
chore(pnpm): drop package.json#pnpm.onlyBuiltDependencies</li>
<li>Additional commits viewable in <a
href="https://github.com/svg/svgo/compare/v4.0.2...v4.1.0">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new
releaser for svgo since your current version.</p>
</details>
<br />
@dg-coreylweathers dg-coreylweathers mentioned this pull request Oct 12, 2026
Merged
dg-coreylweathers added a commit that referenced this pull request Nov 12, 2026
@dg-coreylweathers
ci(release): merge the Homebrew bump PR as soon as it opens (#135)
6537b4f 
## Summary

After the release workflow opens the "Bump deepctl to X" PR on
deepgram/homebrew-tap, it now merges that PR in the same step, using the
same `CLI_TAP_SYNC_PAT` that pushed the branch. The step is also made
safe to re-run and safe against two releases racing on the tap.

## Why

The tap has no branch protection, no checks and no reviewers, so an open
bump PR only delays Homebrew users. The 0.3.1, 0.3.2 and 0.3.3 bumps
(homebrew-tap #9, #10, #11) all sat unmerged while the tap's formula
stayed at 0.2.26. #11 was merged by hand; this keeps that from happening
again.

The formula is generated from PyPI metadata by
`scripts/bump_brew_formula.py`, so there is nothing for a reviewer to
judge in the tap PR itself. The merged PR stays as the audit trail, and
a broken formula is fixed by editing the template, as the generated PR
body already says.

## What changed (`bump-brew-formula` job only)

- **Serialized.** The job gets `concurrency: {group: homebrew-tap-bump,
cancel-in-progress: false}`, so two root releases in quick succession
bump the tap one after the other instead of both reading the same
starting formula.
- **Version guard.** Before touching git, the step reads the version the
tap currently serves from `git show HEAD:Formula/deepgram.rb` (the
regenerate step has already overwritten the working tree, so HEAD is the
tap's state) and the regenerated version from the working tree.
- It fails the job if the tag, the current formula or the regenerated
formula is not a plain `X.Y.Z` version, or if the regenerated formula
does not point at the tagged version.
- It exits 0 with a warning unless the new version is strictly greater
than what the tap serves. Re-running an older release can no longer
downgrade the tap, and re-running a release that already landed is a
no-op.
- **Formula syntax check.** `ruby -c Formula/deepgram.rb` runs before
the commit. This is a Ruby syntax check only: it catches a broken
template or a mangled resource block, not a wrong sha256 or a failing
`brew install`.
- **Re-runnable push and PR.** The branch is pushed with `--force`, so a
re-run replaces a branch left behind by an earlier failed attempt. If an
open PR for that branch already exists, it is reused instead of `gh pr
create` failing on the duplicate.
- The existing-PR lookup only accepts same-repo PRs (`isCrossRepository
== false`) authored by the PAT's own login. The tap is public, so anyone
can open a fork PR whose head branch is named `bump-deepctl-X`; an
unfiltered lookup could have merged it with the PAT.
- The resulting PR URL must match
`https://github.com/deepgram/homebrew-tap/pull/N` or the job fails.
- **Merge with retry.** GitHub computes mergeability after a PR is
created and gh does not wait for it, so `gh pr merge <url> --merge
--delete-branch` is tried up to five times with a short backoff. If a
merge attempt fails but the PR's state is `MERGED` (merged by hand
mid-loop, or merged and then the branch delete failed), that counts as
success. After five failed attempts the job fails with an error
annotation.
- **Stale bump cleanup.** After a successful merge, open
`bump-deepctl-*` PRs that are same-repo, authored by the PAT owner, and
for a strictly older plain `X.Y.Z` version are closed with their branch
deleted and a comment linking the superseding PR. This is best effort:
listing or closing failures emit a warning and never fail the job.

## Checked

- The workflow YAML parses, and `bash -n` passes on the extracted step
script.
- actionlint 1.7.12 with shellcheck 0.11.0 reports 0 findings on
`.github/workflows/release.yml`. The one intentional single-quoted jq
`$login` carries a `shellcheck disable=SC2016` with a comment.
- No job other than `bump-brew-formula` is modified.
- Typed `ci:` so release-please adds no changelog line and bumps no
version for CI plumbing (precedent: #66, #70).

🤖 Generated with [Claude Code](https://claude.com/claude-code)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@lukeocodes lukeocodes Awaiting requested review from lukeocodes

Assignees

No one assigned

Labels

autorelease: tagged

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@lukeocodes