2.26.10

Bug Fixes 🐛

• Bump shell-quote 1.7.3 → ^1.8.4 (GHSA-w7jw-789q-3m8p) by @BYK in #833

2.26.9

Bug Fixes 🐛

• Replace extract-zip with node-stream-zip to fix Node 24.16.0 hang by @BYK in #831

2.26.8

New Features ✨

• (pypi) Support TWINE_VERBOSE env var to pass --verbose to twine upload by @sentry-junior in #829

Bug Fixes 🐛

• Avoid test timeout in extractZipArchive by batching writes by @BYK in #830

2.26.7

Bug Fixes 🐛

• (nuget) Use unique suffix for global.json backup by @jamescrosswell in #823
• (security) Upgrade vitest to ^4.1.0 and tmp to ^0.2.6 by @BYK in #828

2.26.6

Bug Fixes 🐛

• (nuget) Move global.json aside during dotnet setversion by @jamescrosswell in #820
• (security) Override @tootallnate/once to ^2.0.1 (CVE-2026-3449) by @BYK in #822
• Improve partial publishing recovery for CocoaPods and GitHub targets by @BYK in #821

2.26.5

Bug Fixes 🐛

• (security) Bump devalue override to ^5.8.1 (CVE-2026-42570) by @BYK in #818

2.26.4

Bug Fixes 🐛

• (security) Prevent script injection in changelog-preview workflow by @fix-it-felix-sentry in #813
• Resolve open dependabot security alerts by @BYK in #816

Internal Changes 🔧

• (deps-dev) Bump simple-git from 3.33.0 to 3.36.0 by @dependabot in #814

2.26.3

Bug Fixes 🐛

• Prevent shell injection vulnerabilities in GitHub Actions workflows by @fix-it-felix-sentry in #811

2.26.2

Security 🔒

• (deps) Bump uuid to ^14.0.0 (fix GHSA-w5hq-g745-h8pq) by @BYK in #810

Bug Fixes 🐛

• (prepare) Remove --allow-remote-config gate by @BYK in #809

Internal Changes 🔧

• (deps) Bump astro from 5.18.1 to 6.1.6 in /docs by @dependabot in #806
• (deps-dev) Bump fast-xml-parser from 5.5.7 to 5.7.0 by @dependabot in #808

2.26.1

Security 🔒

• (release-env) Allowlist GITHUB_* and RUNNER_* by prefix by @BYK in #807

Bug Fixes 🐛

• (npm) Tolerate workspace:* deps in version bump and bun.lock patching by @BYK in #805

Internal Changes 🔧

• Fix Node 20 + app-id deprecation warnings, refresh Node matrix by @BYK in #803