[dependabot]

Bumps the production group with 33 updates in the / directory:

Package	From	To
@agentclientprotocol/sdk	1.4.0	1.7.0
@aws-sdk/client-bedrock-runtime	3.1123.0	3.1145.0
@lobehub/icons	5.16.0	5.22.0
@modelcontextprotocol/sdk	1.30.0	1.32.0
@xyflow/react	12.11.5	12.12.0
cron-parser	5.10.0	5.10.1
csv-stringify	6.8.3	6.9.0
dompurify	3.4.14	3.4.16
fumadocs-core	16.15.4	16.15.18
fumadocs-ui	16.15.4	16.15.18
jose	6.2.10	6.2.12
js-yaml	5.4.1	5.4.2
lucide-react	1.38.0	1.50.0
marked	18.0.11	18.0.14
material-symbols	0.47.0	0.47.6
mermaid	11.17.2	12.1.0
monaco-editor	0.56.0	0.57.0
next	16.3.5	16.3.8
next-intl	4.14.1	4.14.9
open	11.0.2	11.0.4
pino	10.3.1	10.4.0
playwright	1.62.1	1.63.0
playwright-core	1.62.1	1.63.0
react	19.2.8	19.3.0
react-dom	19.2.8	19.3.0
react-is	19.2.8	19.3.0
react-reconciler	0.33.0	0.34.0
smol-toml	1.8.0	1.9.0
socks	2.8.9	2.8.10
tailwind-merge	3.6.0	3.7.0
tsx	4.23.13	4.23.15
ws	8.21.3	8.22.0
zod	4.5.4	4.6.5

Updates @agentclientprotocol/sdk from 1.4.0 to 1.7.0

Release notes

Sourced from @​agentclientprotocol/sdk's releases.

v1.7.0

1.7.0 (2026-10-02)

Features

• v2: check the extensible-union values you build (#268) (8a60383)

v1.6.1

1.6.1 (2026-10-02)

Bug Fixes

• type the routed connection's closed promise as always present (#265) (9d9fa3d)

v1.6.0

1.6.0 (2026-10-01)

Features

• update schemas to v1.24.1 and v2.0.0-alpha.7 (#263) (a1a80ff)

v1.5.1

1.5.1 (2026-09-28)

Bug Fixes

• bound incoming transport message sizes (#259) (69fda37)
• bound per-connection memory in AcpServer (#261) (4356253)

v1.5.0

1.5.0 (2026-09-21)

Features

• update schemas to v1.22.0 and v2.0.0-alpha.4 (#253) (a9f08bd)
• update schemas to v1.23.0 and v2.0.0-alpha.5 (#255) (f7941e7)

Changelog

Sourced from @​agentclientprotocol/sdk's changelog.

1.7.0 (2026-10-02)

Features

• v2: check the extensible-union values you build (#268) (8a60383)

1.6.1 (2026-10-02)

Bug Fixes

• type the routed connection's closed promise as always present (#265) (9d9fa3d)

1.6.0 (2026-10-01)

Features

• update schemas to v1.24.1 and v2.0.0-alpha.7 (#263) (a1a80ff)

1.5.1 (2026-09-28)

Bug Fixes

• bound incoming transport message sizes (#259) (69fda37)
• bound per-connection memory in AcpServer (#261) (4356253)

1.5.0 (2026-09-21)

Features

• update schemas to v1.22.0 and v2.0.0-alpha.4 (#253) (a9f08bd)
• update schemas to v1.23.0 and v2.0.0-alpha.5 (#255) (f7941e7)

Commits

• 605f3e0 chore(main): release 1.7.0 (#269)
• 8a60383 feat(v2): check the extensible-union values you build (#268)
• 23b3036 chore(main): release 1.6.1 (#267)
• 9d9fa3d fix: type the routed connection's closed promise as always present (#265)
• 55dd374 docs: document when agent connect hooks run (#266)
• 310c27b chore(main): release 1.6.0 (#264)
• a1a80ff feat: update schemas to v1.24.1 and v2.0.0-alpha.7 (#263)
• c77d9bd chore(main): release 1.5.1 (#260)
• b6cf568 chore(deps): bump the minor group with 40 updates (#262)
• 4356253 fix: bound per-connection memory in AcpServer (#261)
• Additional commits viewable in compare view

Updates @aws-sdk/client-bedrock-runtime from 3.1123.0 to 3.1145.0

Release notes

Sourced from @​aws-sdk/client-bedrock-runtime's releases.

v3.1145.0

3.1145.0(2026-10-01)

Chores

• update lock-threads workflow (#8327) (5daff5f2)

Documentation Changes

• client-ec2: This release launches the AMI tag sharing feature, which lets AMI owners share tags alongside their AMIs, eliminating the need to build and maintain custom tag replication workflows. (82608f8c)

New Features

• clients: update client endpoints as of 2026-10-01 (5244c2a9)
• client-bedrock-agent: Adds an optional textReadyAt field to ListIngestionJobs and GetIngestionJob for Managed Knowledge Bases data source sync jobs. The field denotes the timestamp at which all the documents in the scope of a sync job had their text content indexed and are available for retrieval. (a810c753)
• client-lambda-web: Lambda Web Functions GA launch. Lambda Web Functions enable customers to run web applications and API backends (ed0d0540)
• client-quicksight: This release adds HierarchyFilter support for Amazon QuickSight analysis and dashboard and 2 legged OAuth for databricks datasources. (a1730e33)
• client-endusermessaging: AWS End User Messaging now supports Brand profiles and Notify code configurations. Brand profiles capture your sender details once to reuse across phone number registrations. Notify code configurations let you define your OTP policy and delivery settings to send passcodes in minutes. (3e5402c6)
• client-transfer: AWS Transfer Family Workflows adds support for the structuredLogDestinations option, enabling customers to specify a custom Amazon CloudWatch Logs log group for managed workflow execution logs. (db1f8330)
• client-health: Adds DescribeServiceLifecycle operation returning lifecycle information for AWS services, including end-of-support dates, version recommendations, and lifecycle events. (db93c016)
• client-cloudfront: Added always-amz-auth as a supported signing behavior for Origin Access Control (OAC), enabling CloudFront to authenticate requests to Lambda-Web origins. (e24eb7cf)
• client-sagemaker: Release support for c8a.16xlarge and m8a.16xlarge instance types for SageMaker HyperPod (cfa700a6)
• client-securityhub: Adds GetRemediationsV2 and ListExposuresByRemediationV2 APIs. This feature allows customers to see their highest priority remediations for their Exposure findings. Remediations target key changes customers can make to resources to drive finding resolution. (fe355577)

Bug Fixes

• lib-transfer-manager: respect file read stream's byte range on upload (#8324) (449c2814)
• ci: run format-check when a draft PR is marked ready for review (#8326) (d99dd58e)

---

For list of updated packages, view updated-packages.md in assets-3.1145.0.zip

v3.1144.0

3.1144.0(2026-09-30)

Documentation Changes

• client-agent-registry: Minor doc update for the AWS Agent Registry Custom metadata SearchDiscoverableRegistryRecords API (fd88a846)

New Features

• clients: update client endpoints as of 2026-09-30 (d13ef6af)
• client-organizations: Add support for policy operations on the GUARDDUTY POLICY policy type. (407089b4)
• client-s3: Amazon S3 adds a new optional S3 Inventory field, IntelligentTieringReferenceDate, reporting the reference date S3 Intelligent-Tiering uses to evaluate an object's tier-transition eligibility. The value is populated for objects in the Intelligent-Tiering storage class and left blank for others. (82bbbdce)
• client-observabilityadmin: Enablement for Bedrock PaymentManager logs via Observability Admin Telemetry Rule (1f287614)
• client-datazone: Support for setting notebook run notification configurations (e15e2d5b)
• client-guardduty: GuardDuty AWS Organizations policy integration. GetDetector and GetMemberDetectors now show whether a GuardDuty policy manages a feature. (10339365)
• client-cloudwatch-logs: Amazon CloudWatch Logs now supports an optional roleArn parameter on PutDeliveryDestination for X-Ray trace delivery destinations, specifying the IAM role to assume when delivering traces. (735bb3d8)

... (truncated)

Changelog

Sourced from @​aws-sdk/client-bedrock-runtime's changelog.

3.1145.0 (2026-10-01)

Note: Version bump only for package @​aws-sdk/client-bedrock-runtime

3.1144.0 (2026-09-30)

Note: Version bump only for package @​aws-sdk/client-bedrock-runtime

3.1143.0 (2026-09-29)

Note: Version bump only for package @​aws-sdk/client-bedrock-runtime

3.1142.0 (2026-09-28)

Note: Version bump only for package @​aws-sdk/client-bedrock-runtime

3.1141.0 (2026-09-25)

Note: Version bump only for package @​aws-sdk/client-bedrock-runtime

3.1140.0 (2026-09-24)

Note: Version bump only for package @​aws-sdk/client-bedrock-runtime

3.1139.0 (2026-09-23)

... (truncated)

Commits

• 0199117 Publish v3.1145.0
• ce26281 Publish v3.1144.0
• 81afad0 Publish v3.1143.0
• c935fdd Publish v3.1142.0
• 5bc8d9a Publish v3.1141.0
• 6050a38 Publish v3.1140.0
• 03d54a8 Publish v3.1139.0
• c68e50e Publish v3.1138.0
• 9a10476 chore(codegen): sync for MetricsRecorder support and core error/retry fixes (...
• 6b43247 Publish v3.1137.0
• Additional commits viewable in compare view

Updates @lobehub/icons from 5.16.0 to 5.22.0

Changelog

Sourced from @​lobehub/icons's changelog.

Version 5.22.0

Released on 2026-10-01

✨ Features

• auto: Auto build static icons.

What's improved

• auto: Auto build static icons (329f378)

Version 5.21.0

Released on 2026-09-23

✨ Features

• misc: Map Composer models to the Cursor icon.

What's improved

• misc: Map Composer models to the Cursor icon (f0183a2)

... (truncated)

Commits

• 79b551c 🔖 chore(release): v5.22.0 [skip ci]
• 0ced1ec chore: retire issue automation workflows (#426)
• 329f378 ✨ feat(auto): Auto build static icons
• 2242901 fix: isolate SVG definition IDs per icon instance (#423)
• 5c1ecb4 🔖 chore(release): v5.21.0 [skip ci]
• f0183a2 ✨ feat: map Composer models to the Cursor icon
• 951385e 🔖 chore(release): v5.20.0 [skip ci]
• 8196bab ✨ feat: redesign the docs home and show guide pages in the sidebar
• 2e76c48 🔖 chore(release): @​lobehub/icons-static-webp@​1.94.1 [skip ci]
• 49a2130 🔖 chore(release): @​lobehub/icons-static-svg@​1.95.1 [skip ci]
• Additional commits viewable in compare view

Updates @modelcontextprotocol/sdk from 1.30.0 to 1.32.0

Release notes

Sourced from @​modelcontextprotocol/sdk's releases.

1.32.0

Upgrade notes

• Redirects: the HTTP client transports now follow a redirect only when it stays on the same origin (same scheme, host and port; http to https on the same host is allowed). A deployment whose endpoint redirects to another host or port either configures the final URL or sets redirectPolicy: 'follow' on StreamableHTTPClientTransport or SSEClientTransport. In browsers, a redirected request fails unless that option is set.
• New options, both off unless you set them: maxToolInputElements on McpServer limits the number of array elements and object members in a tool call's arguments. expectedResource on requireBearerAuth accepts only tokens issued for this server (the token's audience).

What's Changed

• [v1.x] fix(client): follow redirects only within the endpoint's origin by @​claude[bot] in modelcontextprotocol/typescript-sdk#2902
• docs: point SECURITY.md at GitHub Security Advisories (v1.x) by @​claude[bot] in modelcontextprotocol/typescript-sdk#2910
• [v1.x] examples: close idle sessions and cap the session map by @​maxisbey in modelcontextprotocol/typescript-sdk#2914
• [v1.x] fix(tasks): keep tasks of the in-memory task store within the session that created them by @​claude[bot] in modelcontextprotocol/typescript-sdk#2925
• [v1.x] feat(server): add maxToolInputElements option to limit the number of elements in tool-call arguments by @​claude[bot] in modelcontextprotocol/typescript-sdk#2927
• [v1.x] fix(server): accept tools/call and prompts/get requests that omit arguments by @​raashish1601 in modelcontextprotocol/typescript-sdk#2045
• [v1.x] feat(auth): add expectedResource to requireBearerAuth by @​claude[bot] in modelcontextprotocol/typescript-sdk#2930
• [v1.x] test(e2e): cover tools/call and prompts/get without arguments by @​claude[bot] in modelcontextprotocol/typescript-sdk#2931
• chore: bump version to 1.32.0 by @​claude[bot] in modelcontextprotocol/typescript-sdk#2935

New Contributors

• @​raashish1601 made their first contribution in modelcontextprotocol/typescript-sdk#2045

Full Changelog: modelcontextprotocol/typescript-sdk@1.31.0...1.32.0

1.31.0

Upgrade notes

• Stored OAuth tokens and client information now include an issuer field. Storage that rejects unknown fields needs to allow it.
• Pass expectedIssuer when constructing ClientCredentialsProvider, PrivateKeyJwtProvider or StaticPrivateKeyJwtProvider. Constructing them without it is deprecated.

What's Changed

• [v1.x] Bind stored OAuth credentials to the authorization server that issued them by @​maxisbey in modelcontextprotocol/typescript-sdk#2888
• chore: bump version to 1.31.0 by @​claude[bot] in modelcontextprotocol/typescript-sdk#2890

Full Changelog: modelcontextprotocol/typescript-sdk@1.30.1...1.31.0

1.30.1

What's Changed

• [v1.x] fix(server): read HTTP request bodies with a size limit and bound JSON-RPC batch length by @​maxisbey in modelcontextprotocol/typescript-sdk#2717
• fix(auth): preserve resource URI without trailing slash (#1968) by @​MukundaKatta in modelcontextprotocol/typescript-sdk#1972
• chore: bump version to 1.30.1 by @​claude[bot] in modelcontextprotocol/typescript-sdk#2848

New Contributors

• @​MukundaKatta made their first contribution in modelcontextprotocol/typescript-sdk#1972

Full Changelog: modelcontextprotocol/typescript-sdk@1.30.0...1.30.1

Commits

• 32549b0 chore: bump version to 1.32.0 (#2935)
• 588d51d [v1.x] test(e2e): cover tools/call and prompts/get without arguments (#2931)
• 5a0724d [v1.x] feat(auth): add expectedResource to requireBearerAuth (#2930)
• 0ca0b62 [v1.x] fix(server): accept tools/call and prompts/get requests that omit argu...
• fd26801 [v1.x] feat(server): add maxToolInputElements option to limit the number of e...
• 727075b [v1.x] fix(tasks): keep tasks of the in-memory task store within the session ...
• 0ff6377 [v1.x] examples: close idle sessions and cap the session map (#2914)
• c2ce003 docs: point SECURITY.md at GitHub Security Advisories (v1.x) (#2910)
• 30bfe51 [v1.x] fix(client): follow redirects only within the endpoint's origin (#2902)
• 4b0051f chore: bump version to 1.31.0 (#2890)
• Additional commits viewable in compare view

Updates @xyflow/react from 12.11.5 to 12.12.0

Release notes

Sourced from @​xyflow/react's releases.

@​xyflow/react@​12.12.0

Minor Changes

• #5998 91a4adf - Always fire onResizeEnd after onResizeStart

Patch Changes

• #5998 91a4adf - Fix incorrect values during resize when shouldResize returns false

• Updated dependencies [91a4adf, 91a4adf]:

  • @​xyflow/system@​0.0.83

@​xyflow/react@​12.11.6

Patch Changes

• #5994 2350158 - Reset all properties in provider store when unmounting flow

• #5997 0117cc9 - Prevent attribution warning when pane is not rendered either

• Updated dependencies [0117cc9]:

  • @​xyflow/system@​0.0.82

Changelog

Sourced from @​xyflow/react's changelog.

12.12.0

Minor Changes

• #5998 91a4adf - Always fire onResizeEnd after onResizeStart

Patch Changes

• #5998 91a4adf - Fix incorrect values during resize when shouldResize returns false

• Updated dependencies [91a4adf, 91a4adf]:

  • @​xyflow/system@​0.0.83

12.11.6

Patch Changes

• #5994 2350158 - Reset all properties in provider store when unmounting flow

• #5997 0117cc9 - Prevent attribution warning when pane is not rendered either

• Updated dependencies [0117cc9]:

  • @​xyflow/system@​0.0.82

Commits

• 8716946 chore(packages): bump
• 9fd41fd chore(packages): bump
• 19f9c2a fix(react/store): reset defaultEdgeOptions
• 2acefb5 fix(react/store): reset functions #5991
• See full diff in compare view

Updates cron-parser from 5.10.0 to 5.10.1

Release notes

Sourced from cron-parser's releases.

v5.10.1

What's Changed

• fix: reject duplicate zero values in field validation by @​harrisiirak in harrisiirak/cron-parser#445
• fix: bound field value expansion at parse time by @​harrisiirak in harrisiirak/cron-parser#450

Full Changelog: harrisiirak/cron-parser@v5.10.0...v5.10.1

Changelog

Sourced from cron-parser's changelog.

v5.10.1 - 2026-09-12

What's Changed

• fix: reject duplicate zero values in field validation by @​harrisiirak in harrisiirak/cron-parser#445
• fix: bound field value expansion at parse time by @​harrisiirak in harrisiirak/cron-parser#450

Full Changelog: harrisiirak/cron-parser@v5.10.0...v5.10.1

Commits

• 5b08cdf chore: bump version
• 1d5867c chore: update dev deps
• 95bac55 fix: bound field value expansion at parse time (#450)
• 7b3a0ad chore: add more funding sources to FUNDING.yml
• fc5ca7b chore: add Patreon username for funding support
• 03444a8 chore: update dev deps
• 4fd8809 fix: reject duplicate zero values in field validation (#445)
• See full diff in compare view

Updates csv-stringify from 6.8.3 to 6.9.0

Changelog

Sourced from csv-stringify's changelog.

6.9.0 (2026-09-25)

Features

• csv-stringify: expose csv error and normalize_options (963388d)

Bug Fixes

• csv-stringify: do not alter the source record when columns is set (#504) (041deff)
• csv-stringify: preserve header cast context when eof is false (#505) (a38ef06)
• csv-stringify: preserve negative numeric values (#510) (0002d56)
• csv-stringify: preserve objects returned by cast functions (#509) (1742c9f)
• csv-stringify: quote fields containing a carriage return (#485) (d64d410)

Commits

• 594c646 chore(release): publish
• 9f04145 build: latest dependencies
• d64d410 fix(csv-stringify): quote fields containing a carriage return (#485)
• 963388d feat(csv-stringify): expose csv error and normalize_options
• 041deff fix(csv-stringify): do not alter the source record when columns is set (#504)
• a38ef06 fix(csv-stringify): preserve header cast context when eof is false (#505)
• 8d4173d build: latest dev dependencies
• c8caa1c build: generate latest dist
• 3433750 test: eslint format
• 6c45c9b build: remove npx usage in package scripts
• Additional commits viewable in compare view

Updates dompurify from 3.4.14 to 3.4.16

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.16

• Fixed a problem with IN_PLACE node removal when working with hooks, thanks @​manus-pi
• Fixed a problem with IN_PLACE sanitization and raw-text roots, thanks @​h-t-m
• Fixed a problem with ESM default exports landing in CommonJS declarations, thanks @​ssi02014
• Migrated from rollup to rolldown because performance, thanks @​ssi02014
• Bumped several dependencies where possible

DOMPurify 3.4.15

• Added better clobbering hardening when XML content is involved, thanks @​gnyselcuk
• Added several smaller hardening and edge-case improvements, thanks @​leechristensen
• Bumped several dependencies where possible

Commits

• b9b9d80 release: 3.4.16 (#1636)
• 1d7460c release: 3.4.15 (#1609)
• See full diff in compare view

Updates fumadocs-core from 16.15.4 to 16.15.18

Release notes

Sourced from fumadocs-core's releases.

fumadocs@16.15.18

• @​fumadocs/base-ui@​16.15.18
• fumadocs-core@16.15.18
• fumadocs-ui@16.15.18

Meilisearch integration

Search your docs with Meilisearch, self-hosted or on Meilisearch Cloud.

• toDocuments() and sync() from fumadocs-core/search/meilisearch export your pages and replace the documents of an index, old documents stay searchable until the new ones are indexed.
• meilisearchClient() from fumadocs-core/search/client/meilisearch searches from the browser with useDocsSearch(), filtered by tag and locale.

const client = new Meilisearch({ host, apiKey: searchKey });
useDocsSearch({
client: meilisearchClient({ client, indexName: 'docs', locale }),
});

Set it up with npx @fumadocs/cli feature search --provider meilisearch, or choose it in create-fumadocs-app.

Fix #3627

fumadocs@16.15.17

• @​fumadocs/base-ui@​16.15.17
• fumadocs-core@16.15.17
• fumadocs-ui@16.15.17

Apply the Vite base path to the "View as Markdown" link

<ViewOptionsPopover /> linked to markdownUrl without the Vite base, so sites served under a base path got a 404. It now prefixes the URL like <MarkdownCopyButton /> does.

Fix #3620

fumadocs@16.15.16

• @​fumadocs/base-ui@​16.15.16
• fumadocs-core@16.15.16
• fumadocs-ui@16.15.16

Don't copy failed Markdown responses

<MarkdownCopyButton /> copied the body of error responses, like a 404 page, and kept it cached until a full reload. Failed responses are rejected, and only successful ones are cached.

Fix #3612

Get pages by decoded slugs

getPage() accepts both URI encoded and decoded slugs. React Router and TanStack Router pass decoded params, so pages with spaces or non-ASCII characters in their slugs were not found.

... (truncated)

Commits

• 6ce09d9 Version Packages (#3624)
• 65197b8 ui: no dev cache
• 0a0ce64 docs: remove export-search-indexes.ts
• f0c9d0a fix(openapi): default to basic auth
• 023888c feat(core): support Meilisearch
• f0d7cdb feat(openapi): show download button
• 6c5b179 fix(mdx): collection outside of project dir
• bb43b61 Version Packages (#3621)
• 6791d6f fix(ui): apply the Vite base path to the "View as Markdown" link
• bc42c20 Version Packages (#3618)
• Additional commits viewable in compare view

Updates fumadocs-ui from 16.15.4 to 16.15.18

Release notes

Sourced from fumadocs-ui's releases.

fumadocs@16.15.18

• @​fumadocs/base-ui@​16.15.18
• fumadocs-core@16.15.18
• fumadocs-ui@16.15.18

Meilisearch integration

Search your docs with Meilisearch, self-hosted or on Meilisearch Cloud.

• toDocuments() and sync() from fumadocs-core/search/meilisearch export your pages and replace the documents of an index, old documents stay searchable until the new ones are indexed.
• meilisearchClient() from fumadocs-core/search/client/meilisearch searches from the browser with useDocsSearch(), filtered by tag and locale.

const client = new Meilisearch({ host, apiKey: searchKey });
useDocsSearch({
client: meilisearchClient({ client, indexName: 'docs', locale }),
});

Set it up with npx @fumadocs/cli feature search --provider meilisearch, or choose it in create-fumadocs-app.

Fix #3627

fumadocs@16.15.17

• @​fumadocs/base-ui@​16.15.17
• fumadocs-core@16.15.17
• fumadocs-ui@16.15.17

Apply the Vite base path to the "View as Markdown" link

<ViewOptionsPopover /> linked to markdownUrl without the Vite base, so sites served under a base path got a 404. It now prefixes the URL like <MarkdownCopyButton /> does.

Fix #3620

fumadocs@16.15.16

• @​fumadocs/base-ui@​16.15.16
• fumadocs-core@16.15.16
• fumadocs-ui@16.15.16

Don't copy failed Markdown responses

<MarkdownCopyButton /> copied the body of error responses, like a 404 page, and kept it cached until a full reload. Failed responses are rejected, and only successful ones are cached.

Fix #3612

Get pages by decoded slugs

getPage() accepts both URI encoded and decoded slugs. React Router and TanStack Router pass decoded params, so pages with spaces or non-ASCII characters in their slugs were not found.

... (truncated)

Commits

• 6ce09d9 Version Packages (#3624)
• 65197b8 ui: no dev cache
• 0a0ce64 docs: remove export-search-indexes.ts
• f0c9d0a fix(openapi): default to basic auth
• 023888c feat(core): support Meilisearch
• f0d7cdb feat(openapi): show download button
• 6c5b179 fix(mdx): collection outside of project dir
• bb43b61 Version Packages (#3621)
• 6791d6f fix(ui): apply the Vite base path to the "View as Markdown" link
• bc42c20 Version Packages (#3618)
• Additional commits viewable in compare view

Updates jose from 6.2.10 to 6.2.12

Release notes

Sourced from jose's releases.

v6.2.12

Documentation

• clarify and shorten public API guidance (be62530)

Refactor

• simplify JWS and JWE operation cores (92e9640)

Performance

• avoid copying AES-GCM output (6925d43)
• deduplicate pending jwks key imports (bf5138b)
• encode single-signature JWS input once (7bc9a33)
• normalize General JWE shared headers once (78637bd)
• normalize jwks selection metadata once (fd3ae3f)
• use native encoding for larger ASCII strings (b23a6f3)

v6.2.11

Documentation

• render subpath indexes as tables (94589ee)
• shorten API index descriptions (681482f)

Refactor

• model JWE key management modes (e01dda6)
• types: reduce declaration repetition (55b970f)

Changelog

Sourced from jose's changelog.

6.2.12 (2026-09-05)

Documentation

• clarify and shorten public API guidance (be62530)

Refactor

• simplify JWS and JWE operation cores (92e9640)

Performance

• avoid copying AES-GCM output (6925d43)
• deduplicate pending jwks key imports (bf5138b)
• encode single-signature JWS input once (7bc9a33)
• normalize General JWE shared headers once (78637bd)
• normalize jwks selection metadata once (fd3ae3f)
• use native encoding for larger ASCII strings (b23a6f3)
...

Description has been truncated

[github-actions]

CI Coverage Report

• Coverage job: skipped
• PR test policy: success

Coverage artifact was not available for this run.

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.