v2.0.4

The binaries are built with Bun 1.4.4, which fixes an out-of-bounds write in Bun's brotli decoder (CVE-2026-111497, GHSA-663w-cv8g-jj2p). It is reachable from brotli-encoded fetch responses, node:zlib and DecompressionStream("brotli"), so update the CLI binary if you installed v2.0.3 or earlier. (#127)

Dependencies

• The @probitas-test/* packages move to their latest patch releases (@probitas-test/runner 0.5.8, @probitas-test/builder 0.5.4, the clients and @probitas-test/expect). (#135)
• The binary embeds LogTape 2.4. (#131, #132)

Nix

• The flake's package builds on Darwin. (#126, thanks @natsukium)
• Bun is pinned to 1.4.4 and the flake inputs are updated. (#127, #128)

Repository and release tooling

• Dependabot keeps the npm dependencies and the GitHub Actions current, and a daily workflow updates the flake inputs and the Bun pin; both open pull requests whose CI runs without approval. (#127, #134)
• deno.json (the JSR manifest) is generated from package.json when publishing and no longer committed. (#134)
• The development toolchain moves to TypeScript 7, Biome 2.6 and dprint 0.64. (#130, #135)