From 987c0ce5dc9702a436dcda504d359f2d72508b5d Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Fri, 26 Jun 2026 14:08:15 +0000
Subject: [PATCH] Publish packages

---
 .../threads-window-origin-validation.md       | 24 ------------------
 packages/threads/CHANGELOG.md                 | 25 +++++++++++++++++++
 packages/threads/package.json                 |  2 +-
 3 files changed, 26 insertions(+), 25 deletions(-)
 delete mode 100644 .changeset/threads-window-origin-validation.md

diff --git a/.changeset/threads-window-origin-validation.md b/.changeset/threads-window-origin-validation.md
deleted file mode 100644
index 666bc2771..000000000
--- a/.changeset/threads-window-origin-validation.md
+++ /dev/null
@@ -1,24 +0,0 @@
----
-'@quilted/threads': minor
----
-
-`ThreadWindow`'s `targetOrigin` option now also validates the `origin` of incoming messages, and gained an `'ancestor'` mode.
-
-Previously `targetOrigin` only set the origin for outgoing `postMessage()` calls; inbound messages were accepted from any origin as long as they came from the expected window. It is now also used to reject messages whose `origin` does not match, so a concrete `targetOrigin` authenticates both directions:
-
-```ts
-const thread = ThreadWindow.iframe(iframe, {
-  targetOrigin: 'https://embed.my-app.com',
-  exports: {
-    /* ... */
-  },
-});
-```
-
-The default remains `'*'` (post to, and accept from, any origin), so existing behaviour is unchanged.
-
-You can also pass `targetOrigin: 'ancestor'` to pin to the origin that framed the current window — read from `location.ancestorOrigins`, falling back to the origin of the first received message on platforms without that API (e.g. Firefox), buffering outgoing messages until it is known. This is convenient inside an `iframe` that trusts its embedder but doesn't know the embedder's origin ahead of time:
-
-```ts
-const thread = ThreadWindow.parent({targetOrigin: 'ancestor'});
-```
diff --git a/packages/threads/CHANGELOG.md b/packages/threads/CHANGELOG.md
index 4069d3ea1..f4cb89a72 100644
--- a/packages/threads/CHANGELOG.md
+++ b/packages/threads/CHANGELOG.md
@@ -1,5 +1,30 @@
 # @quilted/threads
 
+## 4.1.0
+
+### Minor Changes
+
+- [#968](https://github.com/lemonmade/quilt/pull/968) [`b17b028`](https://github.com/lemonmade/quilt/commit/b17b028af8a8bf239f0e6b2ab76c4bf1fa78db84) Thanks [@lemonmade](https://github.com/lemonmade)! - `ThreadWindow`'s `targetOrigin` option now also validates the `origin` of incoming messages, and gained an `'ancestor'` mode.
+
+  Previously `targetOrigin` only set the origin for outgoing `postMessage()` calls; inbound messages were accepted from any origin as long as they came from the expected window. It is now also used to reject messages whose `origin` does not match, so a concrete `targetOrigin` authenticates both directions:
+
+  ```ts
+  const thread = ThreadWindow.iframe(iframe, {
+    targetOrigin: 'https://embed.my-app.com',
+    exports: {
+      /* ... */
+    },
+  });
+  ```
+
+  The default remains `'*'` (post to, and accept from, any origin), so existing behaviour is unchanged.
+
+  You can also pass `targetOrigin: 'ancestor'` to pin to the origin that framed the current window — read from `location.ancestorOrigins`, falling back to the origin of the first received message on platforms without that API (e.g. Firefox), buffering outgoing messages until it is known. This is convenient inside an `iframe` that trusts its embedder but doesn't know the embedder's origin ahead of time:
+
+  ```ts
+  const thread = ThreadWindow.parent({targetOrigin: 'ancestor'});
+  ```
+
 ## 4.0.3
 
 ### Patch Changes
diff --git a/packages/threads/package.json b/packages/threads/package.json
index 7b3fe9d3a..9a0c50218 100644
--- a/packages/threads/package.json
+++ b/packages/threads/package.json
@@ -2,7 +2,7 @@
   "name": "@quilted/threads",
   "description": "Helpers for communicating between JavaScript environments using message passing.",
   "type": "module",
-  "version": "4.0.3",
+  "version": "4.1.0",
   "license": "MIT",
   "engines": {
     "node": ">=14.0.0"