joeyr
released this
| 22 commits to main since this release
Fixed
- CI's dependency audit passes again. Two high-severity packages had new
advisories published today. One was undici 6.27.0, which discord.js uses
for every request to Discord, with six advisories fixed in 6.28.1. The
other was brace-expansion 5.0.9, used only by the linter, with three fixed
in 5.0.12. Both now resolve to their newest versions, and npm audit
reports nothing at any severity.
- A test that failed about one run in five now passes every time. The
bot-message exclusion tests searched the context for each bot message's
text. Random users can legitimately carry the same text, for example a
user named __de beside a bot message reading __de. The code was right
each time. Each bot message now carries a marker no generated user can
produce, and the tests check for that. With the bot filter deliberately
broken, all three tests fail. With it in place, 25 runs in a row passed.
Changed
- Every dependency is on its newest release. That includes discord.js
14.27.0, the Anthropic SDK 0.131.0, the MCP SDK 1.32.0, dotenv 18.0.5, pg
8.23.1, and every dev tool. Nothing the bot uses changed in dotenv 18,
which removed .env.vault support and -r dotenv/config preloading.
Two packages stay behind, and both are held there because something else
requires it. TypeScript stays on 6.0 because typescript-eslint and ts-jest
don't support 7 yet. @types/node stays on 22 to match the Node 22
runtime.
- Two dependency overrides are gone. The undici override is redundant
now that discord.js asks for ^6.27.0 itself. brace-expansion resolves
its newest release without help. Those that remain only ever force a
newer version than a package asks for, and their floors are raised to
the newest releases.
Downloads