From f81a95ed1dcf42e50b9320621fa82ce9e0f36776 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 17 Jun 2026 22:02:14 +0000 Subject: [PATCH] Version Packages --- .changeset/js-yaml-merge-key-dos.md | 5 ----- CHANGELOG.md | 6 ++++++ package.json | 2 +- 3 files changed, 7 insertions(+), 6 deletions(-) delete mode 100644 .changeset/js-yaml-merge-key-dos.md diff --git a/.changeset/js-yaml-merge-key-dos.md b/.changeset/js-yaml-merge-key-dos.md deleted file mode 100644 index 5e84b40..0000000 --- a/.changeset/js-yaml-merge-key-dos.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"deck-wind-layer": patch ---- - -Resolve the `js-yaml` merge-key DoS advisory ([GHSA-h67p-54hq-rp68](https://github.com/advisories/GHSA-h67p-54hq-rp68)) by forcing the transitive dependency to the patched 4.2.0 via pnpm `overrides` (`read-yaml-file` → ^2.1.0, `js-yaml` → ^4.2.0). The vulnerable 3.14.2 came in only through the changesets release toolchain, so this is a dev-tooling fix — the published bundle is unchanged. diff --git a/CHANGELOG.md b/CHANGELOG.md index 06f0032..749c0fc 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,11 @@ # Changelog +## 0.1.1 + +### Patch Changes + +- fe93bbb: Resolve the `js-yaml` merge-key DoS advisory ([GHSA-h67p-54hq-rp68](https://github.com/advisories/GHSA-h67p-54hq-rp68)) by forcing the transitive dependency to the patched 4.2.0 via pnpm `overrides` (`read-yaml-file` → ^2.1.0, `js-yaml` → ^4.2.0). The vulnerable 3.14.2 came in only through the changesets release toolchain, so this is a dev-tooling fix — the published bundle is unchanged. + The format is based on [Keep a Changelog](https://keepachangelog.com/), and this project adheres to [Semantic Versioning](https://semver.org/). diff --git a/package.json b/package.json index a176605..e222ad9 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "deck-wind-layer", - "version": "0.1.0", + "version": "0.1.1", "description": "A deck.gl v9 wind-particle layer — GPU advection, fading comet trails, camera-synced, with constant on-screen density at any zoom.", "license": "MIT", "author": "John Carmack",