v0.2.61

[0.2.61] - 2026-06-01

Security

• Bumped qs to >=6.15.2 to address a remotely triggerable DoS (qs.stringify crash on null/undefined entries in comma-format arrays when encodeValuesOnly is set), pulled in transitively via express. (CYPACK-1269, #1274)

Changed

• Updated @anthropic-ai/claude-agent-sdk from 0.3.158 to 0.3.159. Tool list is unchanged (33 tools). See the SDK changelog for details. (CYPACK-1271, #1277)
• Updated @anthropic-ai/claude-agent-sdk from 0.3.156 to 0.3.158. Tool list is unchanged (33 tools). See the SDK changelog for details. (CYPACK-1268, #1275)
• Updated @anthropic-ai/claude-agent-sdk from 0.3.154 to 0.3.156 and @anthropic-ai/sdk from 0.100.0 to 0.100.1. See the SDK changelog for details. (CYPACK-1265, #1270)

Added

• New "PR review trigger" control: when disabled, a pull request review that requests changes on a Cyrus-opened PR no longer auto-starts a Cyrus session or posts an acknowledgement comment. Enabled by default, so existing behaviour is unchanged unless you turn it off. (CYPACK-1273, #1278)
• A repository can now ship its own skills: any skill directories under <repo>/.claude/skills/ are automatically discovered and made available to the agent whenever Cyrus works in that repo — for single-repo issues, multi-repo issues (skills from every participating repo are combined), and GitHub/GitLab mentions alike. (CYPACK-1261, #1268)