Skip to content

v1.20.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 30 Jul 04:13
v1.20.0
9a7c533

Requires action before upgrading

Node.js 24 is now the minimum. Building or deploying on Node 22 fails at npm ci. Upgrade your build/deploy host first — the repo's .nvmrc now reads 24:

nvm install 24 && nvm use 24
npm ci          # re-run after switching; a node_modules built on 22 can carry incompatible binaries

npm run upgrade prints these steps for you. No D1 migrations, no new secrets, and the renderer version stays at 1 — nothing to re-render, and rolling back means redeploying the previous tag.

Security

npm audit goes from 6 vulnerabilities (5 high, 1 moderate) to 0. The high-severity sharp/miniflare/postcss chain entered through the old vitest-pool-workers and wrangler; the three moderate advisories were in hono and are cleared by 4.12.32. Only hono, marked, and wrangler's bundler affect the deployed Worker — the rest are build-time only.

Dependencies

  • hono 4.12.25 → 4.12.32, marked 18.0.4 → 18.0.7
  • wrangler 4.106 → 4.115, typescript 5.9.3 → 7.0.2 (the native port; zero source or tsconfig changes)
  • @cloudflare/workers-types v4 → v5 (v4 froze upstream), vitest-pool-workers 0.16 → 0.19, @types/node → 24 to match the engine floor, vitest 4.1.7 → 4.1.10, tsx 4.22.3 → 4.23.1

CI

Every workflow had been dark. All three gated their jobs on github.event.repository.private == false, which became a permanent no-op once the repo went public, and agents-docs-sync.yml additionally had no workflow_dispatch, so its gate was unreachable by any route. Guards removed, dispatch added, checkout pinned to @v6.

Documentation

Fifteen corrections from a full read pass against source. The ones that change what an operator can actually do:

  • All five OAuth providers are now documented. AGENTS.md, AGENTS-OPERATE.md, and INSTALL.md all claimed GitHub + Google only, and the AGENTS-OPERATE secret table omitted FACEBOOK_*, TWITTER_*, and DISCORD_* entirely — those providers have shipped since v1.13.0 but were undiscoverable to anyone following the guide. Setup walkthroughs, scopes, and callback URLs added for each; note the X provider slug is twitter, since it's the stored value in users.provider.
  • /admin/settings is editable, not read-only. It has persisted feature flags and display/pagination numbers to the settings D1 table since v1.10.0 — no redeploy needed. The docs still sent you to wrangler secret put for everything.
  • The comment-tree cache is the Cache API, not KV (docs/troubleshooting.md). It moved after a KV write-cap incident. The 60s TTL and the absence of global invalidation are now documented, so the up-to-a-minute delay before a moderation action reaches anonymous viewers is expected behavior rather than a bug report.
  • comment.reported — the sixth webhook event — was missing from docs/webhooks.md.
  • TURNSTILE_SECRET_KEY → TURNSTILE_SECRET in examples/README.md (the wrong name simply doesn't work), and IP_HASH_SECRET is HMAC-SHA-256, not BLAKE3.

Contributor-facing: CLAUDE.md and CONTRIBUTING.md claimed tests run against Miniflare — they run in Vitest's plain node pool against hand-rolled in-memory D1/KV stubs. The README's widget size is now the measured 11.53 KB gzipped against the CI-enforced 20 KB ceiling.

Full Changelog: v1.19.1...v1.20.0

Assets 5
Loading