v7.1.3

v7.1.3 — 2026-09-02

Supply-chain hardening and dependency-maintenance patch across all packages. No API or behavior changes.

Bug Fixes

• override axios to 1.19.0 to remediate CVE-2025-62718, CVE-2026-42043, and CVE-2026-42044 (4be207b, #634)

Documentation

• add SECURITY.md and DEFENSE_IN_DEPTH.md (9fc9c71, #635)
• record repository lockdown (62f1e25, #650)
• record lockdown checklist complete (8109d90, #651)
• record completed npm publishing manuals (7c24d2e, #652)

Internal

• allow workerd build scripts to fix Cloudflare Pages deploy (099e5b8, #632)
• add CODEOWNERS for high-risk paths (1527b31, #636)
• bootstrap Aikido Safe Chain for cloud agents (38ca49f, #637)
• set 7-day pnpm dependency cooldown (2a41d1a, #638)
• set pnpm trustPolicy to no-downgrade (0ae1dae, #639)
• block pnpm lifecycle scripts by default (2510b2b, #640)
• block exotic pnpm subdependencies (e15f699, #641)
• set permissions: contents: read default (77bc626, #642)
• pin all GitHub Actions via actions-up (a2bedf5, #643)
• wrap CI installs with Socket Firewall (76c0d70, #644)
• lint GitHub Actions workflows with zizmor (f83b4e2, #645)
• disable persist-credentials on checkouts (cd0122e, #646)
• disable setup-node cache on publish jobs (890a8a7, #647)
• stage npm publishes from packed tarball (489baac, #648)
• gate npm stage publish on Aikido scan-release (fcaae69, #649)
• remove axios override (0cb8529, #653)
• upgrade code quality dependencies: @biomejs/biome 2.5.6→2.5.10, vitest & @vitest/coverage-v8 4.1.10→4.1.11 (9a20cd9, #654)
• upgrade TypeScript and build tooling: typescript 6.0.3→7.0.2, tsx 4.23.1→4.23.12, @types/node 24.12.2→26.3.0, docula 2.2.0→3.0.0 (9f5b1fe, #655)
• upgrade GitHub Actions: CodeQL 4.37.9, zizmor-action 0.6.3, Socket Firewall 1.15.1 (079c38d, #656)
• pin Dev Container images (58ff1e4, #657)
• upgrade @aws-sdk/client-ses & @aws-sdk/client-sns 3.1099.0→3.1118.0 (690cf14, #658)
• upgrade hookified 3.0.2→3.0.3 (22b7861, #659)
• upgrade pingram 1.0.16→1.0.25 (8616447, #660)
• upgrade twilio 6.0.2→6.1.0 (89a0b0c, #661)
• upgrade ecto 5.0.0→5.1.0 (4f33419, #662)

Contributors

• @jaredwray (29)

Full List of Changes

• Allow workerd build scripts to fix Cloudflare Pages deploy by @jaredwray in #632
• fix: override axios to 1.19.0 for CVE-2025-62718, CVE-2026-42043, and CVE-2026-42044 by @jaredwray in #634
• mono - chore: defense - add SECURITY.md and DEFENSE_IN_DEPTH.md by @jaredwray in #635
• mono - chore: defense - add CODEOWNERS for high-risk paths by @jaredwray in #636
• mono - chore: defense - bootstrap Aikido Safe Chain for cloud agents by @jaredwray in #637
• mono - chore: defense - set 7-day pnpm dependency cooldown by @jaredwray in #638
• mono - chore: defense - set pnpm trustPolicy to no-downgrade by @jaredwray in #639
• mono - chore: defense - block pnpm lifecycle scripts by default by @jaredwray in #640
• mono - chore: defense - block exotic pnpm subdependencies by @jaredwray in #641
• mono - chore: defense - set permissions: contents: read default by @jaredwray in #642
• mono - chore: defense - pin all GitHub Actions via actions-up by @jaredwray in #643
• mono - chore: defense - wrap CI installs with Socket Firewall by @jaredwray in #644
• mono - chore: defense - lint GitHub Actions workflows with zizmor by @jaredwray in #645
• mono - chore: defense - disable persist-credentials on checkouts by @jaredwray in #646
• mono - chore: defense - disable setup-node cache on publish jobs by @jaredwray in #647
• mono - chore: defense - stage npm publishes from packed tarball by @jaredwray in #648
• mono - chore: defense - gate npm stage publish on Aikido scan-release by @jaredwray in #649
• mono - chore: defense - record repository lockdown by @jaredwray in #650
• mono - chore: defense - record lockdown checklist complete by @jaredwray in #651
• mono - chore: defense - record completed npm publishing manuals by @jaredwray in #652
• mono - chore: remove axios override by @jaredwray in #653
• mono - chore: upgrade code quality dependencies by @jaredwray in #654
• mono - chore: upgrade TypeScript and build tooling by @jaredwray in #655
• mono - chore: upgrade GitHub Actions by @jaredwray in #656
• mono - chore: pin Dev Container images by @jaredwray in #657
• aws - chore: upgrade AWS SDK dependencies by @jaredwray in #658
• airhorn - chore: upgrade hookified by @jaredwray in #659
• pingram - chore: upgrade pingram by @jaredwray in #660
• twilio - chore: upgrade twilio by @jaredwray in #661
• airhorn - chore: upgrade ecto by @jaredwray in #662

Full diff: v7.1.2...v7.1.3