Release v2.2.0 #5330

Activity

1. cliffhall

   added this to the v2.2.0 milestone on Oct 28, 2026
2. cliffhall

   added

   v2

   choreMaintenance: deps, build tooling, CI, cleanup — no user-facing behavior changeMaintenance: deps, build tooling, CI, cleanup — no user-facing behavior change

   on Oct 28, 2026
3. cliffhall

   self-assigned this

   on Oct 28, 2026
4. cliffhall

   linked a pull request that will close this issuechore: version packages #5296on Oct 28, 2026
5. cliffhall commented on Oct 28, 2026

   

   cliffhall

   on Oct 28, 2026

   MemberAuthor

   More actions

   Release audit (step 2a), on origin/v2/main b711f8d

   Python (uv export --frozen → pip-audit --require-hashes): fetch, git and time each audited, no known vulnerabilities.

   npm (npm audit, root lockfile covering all four workspaces): 1 moderate, 0 high, 0 critical.

   Package	Advisory	Path	Outcome
   qs 6.16.0	GHSA-6pq8-jhm2-2vcw: qs.stringify with arrayFormat: 'comma' throws on array elements with a non-callable own toString (DoS)	server-everything → express@5.2.1 (and its body-parser@2.4.0)	No fix: not reachable

   The vulnerable code is qs.stringify. express (lib/utils.js) and body-parser (lib/types/urlencoded.js) use qs only to parse query strings and urlencoded bodies; neither calls stringify. The patched qs is inside express's declared range (^6.14.0), so a fresh install of the published package already resolves it. The maintainer decided: no lockfile bump.

   No fixes were forced, so there is no audit PR.
6. cliffhall

   linked a pull request that will close this issuechore: stamp Python CalVer versions for 2026.10.28 #5336on Oct 28, 2026
7. cliffhall

   closed this as completedon Oct 28, 2026