javascript: v0.4.12

0.4.12 (2026-06-04)

Features

• #318: add context param to JudgmentRequest for extra judge evaluation input (#554) (1947824)
• add GOAT strategy with dynamic technique selection for RedTeamAgent (#346) (2896c97)
• ci/#364: add pr-auto-approve.yml as passive observer (PR #1 of 4) (#485) (4d84597)
• red-team: zero-friction report dashboard — auto-save + scenario redteam-report CLI (2896c97)
• test/#516: bind PR #511 voice scenarios via vitest-cucumber (retrofit PR-A) (#517) (c247f42)
• typescript-sdk/#372: voice agent contract surface (types only, PR1 of N) (#511) (9216d35)
• typescript-sdk: voice agent testing — consolidated clean stack (#561) (5847c4b)

Bug Fixes

• deps: bump fast-uri to >=3.1.2 for high severity CVEs (#450) (474ab65)
• deps: bump fast-uri to >=3.1.2 to resolve high severity vulnerabilities (474ab65)
• deps: bump liquidjs override to >=10.26.0 to close RCE/ReDoS alerts (#591) (daaf9cc)
• deps: bump protobufjs to >=7.5.6/>=8.0.2 for high severity CVEs (#463) (f008161)
• deps: bump protobufjs to >=8.0.2 for 4 high severity CVEs (#462) (e2c0499)
• deps: override hono to >=4.12.18 for JWT NumericDate validation CVE (#477) (d81ff1a)
• deps: override langsmith to >=0.6.0 for CVE fix (#471) (4e5237e)
• deps: override langsmith to >=0.6.0 for prompt deserialization CVEs (4e5237e)
• deps: override minimatch to >=9.0.6 (CVE-2026-26996) (#395) (ceb0b59)
• deps: override qs to >=6.14.2 for arrayLimit bypass DoS CVE (#482) (51a2b6d)
• deps: resolve 4 high-severity Dependabot security alerts (#393) (97f257d)
• examples: stabilize custom LLM judge criteria matching (#396) (f4b536c)
• examples: use positional index matching in custom judge examples (f4b536c)
• judge: harden forceVerdict so discovery tools cannot leak (JS + Python) (#377) (0e2859f)
• red-team: annotate H_attacker when post-hoc injection fires (#326, #334) (2896c97)
• security: bump liquidjs override to fix memoryLimit bypass, memory amplification, and DoS CVEs (25ba99d)
• security: bump liquidjs to fix 4 additional high-severity CVEs (#412) (25ba99d)
• security: delete orphaned vitest lockfile recreated during rebase (ea8a19c)
• security: delete orphaned vitest lockfile to fix 8 Dependabot alerts (#426) (ea8a19c)
• security: patch @modelcontextprotocol/sdk ReDoS, DNS rebinding, and data leak (#410) (b993066)
• security: patch @modelcontextprotocol/sdk ReDoS, DNS rebinding, and data leak CVEs (b993066)
• security: patch critical CVEs in protobufjs and handlebars (#390) (de89d50)
• security: patch critical vulnerabilities in protobufjs and handlebars (de89d50)
• security: patch CVE-2026-27903 in minimatch (#398) (b61cc60)
• security: patch flatted prototype pollution via parse() (#421) (3a20e6c)
• security: patch langchain serialization injection vulnerability (#420) (89dd094)
• security: patch path-to-regexp DoS in openai-realtime-demo (c6e55b0)
• security: patch path-to-regexp DoS in openai-realtime-demo (CVE-2026-4926) (#428) (c6e55b0)
• security: patch path-to-regexp DoS via sequential optional groups (#416) (752539a)
• security: patch rollup arbitrary file write via path traversal (#399) (55a0259)
• security: patch rollup path traversal CVE (>= 4.0.0, < 4.59.0) (55a0259)
• security: patch trim-newlines uncontrolled resource consumption (#415) (1c507c3)
• security: patch vite server.fs.deny bypass and WebSocket file read CVEs (#419) (7bb7af9)
• security: upgrade picomatch, @hono/node-server, and glob to fix CVEs (#394) (4395e52)

Miscellaneous

• deps: bump @ungap/structured-clone past 1.3.1 (CWE-502) (#544) (f716e46)
• deps: bump pnpm/action-setup from 2.4.1 to 5.0.0 (#300) (053cc3a)
• deps: remove unused nanoid-cli devDep from vitest examples (#422) (d4a40a5)
• main-side cleanup — docs + spec + python/TS parity (#586) (371f94c)
• tests: remove flaky 10-turn travel-planning example test (#423) (bbe86de)
• tests: remove flaky live-LLM travel-agent example test (ac911ff)
• tests: remove flaky travel-agent example test (#425) (ac911ff)
• tests: remove no-op example tests + audit notes (#424) (947f219)
• tests: remove no-op example tests that always pass or are skipped (947f219)

Code Refactoring

• test/#522: move instanceof assertions from Given to Then in voice contract surface (#559) (c8cca4e)