2.26.6

Bug Fixes 🐛

• (nuget) Move global.json aside during dotnet setversion by @jamescrosswell in #820
• (security) Override @tootallnate/once to ^2.0.1 (CVE-2026-3449) by @BYK in #822
• Improve partial publishing recovery for CocoaPods and GitHub targets by @BYK in #821

2.26.5

Bug Fixes 🐛

• (security) Bump devalue override to ^5.8.1 (CVE-2026-42570) by @BYK in #818

2.26.4

Bug Fixes 🐛

• (security) Prevent script injection in changelog-preview workflow by @fix-it-felix-sentry in #813
• Resolve open dependabot security alerts by @BYK in #816

Internal Changes 🔧

• (deps-dev) Bump simple-git from 3.33.0 to 3.36.0 by @dependabot in #814

2.26.3

Bug Fixes 🐛

• Prevent shell injection vulnerabilities in GitHub Actions workflows by @fix-it-felix-sentry in #811

2.26.2

Security 🔒

• (deps) Bump uuid to ^14.0.0 (fix GHSA-w5hq-g745-h8pq) by @BYK in #810

Bug Fixes 🐛

• (prepare) Remove --allow-remote-config gate by @BYK in #809

Internal Changes 🔧

• (deps) Bump astro from 5.18.1 to 6.1.6 in /docs by @dependabot in #806
• (deps-dev) Bump fast-xml-parser from 5.5.7 to 5.7.0 by @dependabot in #808

2.26.1

Security 🔒

• (release-env) Allowlist GITHUB_* and RUNNER_* by prefix by @BYK in #807

Bug Fixes 🐛

• (npm) Tolerate workspace:* deps in version bump and bun.lock patching by @BYK in #805

Internal Changes 🔧

• Fix Node 20 + app-id deprecation warnings, refresh Node matrix by @BYK in #803

2.26.0

Security 🔒

• (ci) Pin third-party GitHub Actions to commit SHAs by @BYK in #801
• (commit-repo) Replace execSync tar with node-tar by @BYK in #799
• (gpg) Pipe private key via stdin instead of writing to /tmp by @BYK in #798
• (publish) Move publish-state file out of repo cwd by @BYK in #797
• (spawn) Strip dynamic-linker env vars from subprocess env by @BYK in #800

New Features ✨

• Recognize security: commit prefix for changelog and versioning by @BYK in #802

2.25.5

Bug Fixes 🐛

Security

• Move workflow to pull_request and do not persist creds by @geoffg-sentry in #796
• Disable .craft.env reading and harden release subprocess env by @BYK in #794

2.25.4

Bug Fixes 🐛

• (publish) Replace CRAFT_NEW_VERSION with CRAFT_RELEASED_VERSION in post-release env by @BYK in #793

2.25.3

Bug Fixes 🐛

• (deps) Address security vulnerabilities in vite, picomatch, and defu by @BYK in #791
• (publish) Distinguish auth failures from merge conflicts in post-publish merge by @BYK in #788