chore(release): version packages

[github-actions]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

@csrf-armor/core@1.2.3

Patch Changes

• #52 440e0af Thanks @muneebs! - chore(deps): patch transitive dev dependency security advisories

  Bumps pnpm overrides for vite (^6.4.1 → ^6.4.2) and unhead (>=2.1.11 → >=2.1.13) to pull in patched versions. These are dev/build-time dependencies only — no runtime behavior or published API changes.

  Addresses:

  • GHSA: Vite arbitrary file read via dev server WebSocket (high, <=6.4.1)
  • GHSA: Vite path traversal in optimized deps .map handling (medium, <=6.4.1)
  • GHSA: Unhead hasDangerousProtocol() bypass via leading-zero padded HTML entities in useHeadSafe() (medium, <2.1.13)

@csrf-armor/express@1.2.3

Patch Changes

• #52 440e0af Thanks @muneebs! - chore(deps): patch transitive dev dependency security advisories

  Bumps pnpm overrides for vite (^6.4.1 → ^6.4.2) and unhead (>=2.1.11 → >=2.1.13) to pull in patched versions. These are dev/build-time dependencies only — no runtime behavior or published API changes.

  Addresses:

  • GHSA: Vite arbitrary file read via dev server WebSocket (high, <=6.4.1)
  • GHSA: Vite path traversal in optimized deps .map handling (medium, <=6.4.1)
  • GHSA: Unhead hasDangerousProtocol() bypass via leading-zero padded HTML entities in useHeadSafe() (medium, <2.1.13)

• Updated dependencies [440e0af]:

  • @csrf-armor/core@1.2.3

@csrf-armor/nextjs@1.4.3

Patch Changes

• #50 7d4adeb Thanks @muneebs! - fix(client): preserve headers when csrfFetch is called with a Request object

  csrfFetch previously only read headers from the init argument, so when it was called with a full Request object (e.g. csrfFetch(new Request(url, { headers }))), the Request's headers were stripped. It now merges headers from the Request, then the init argument, then the CSRF headers (CSRF headers always take precedence), making csrfFetch a drop-in replacement for fetch.

  Fixes Bug: csrfFetch strips headers when the first argument is a Request #49

• #52 440e0af Thanks @muneebs! - chore(deps): patch transitive dev dependency security advisories

  Bumps pnpm overrides for vite (^6.4.1 → ^6.4.2) and unhead (>=2.1.11 → >=2.1.13) to pull in patched versions. These are dev/build-time dependencies only — no runtime behavior or published API changes.

  Addresses:

  • GHSA: Vite arbitrary file read via dev server WebSocket (high, <=6.4.1)
  • GHSA: Vite path traversal in optimized deps .map handling (medium, <=6.4.1)
  • GHSA: Unhead hasDangerousProtocol() bypass via leading-zero padded HTML entities in useHeadSafe() (medium, <2.1.13)

• Updated dependencies [440e0af]:

  • @csrf-armor/core@1.2.3

@csrf-armor/nuxt@1.1.2

Patch Changes

• #50 7d4adeb Thanks @muneebs! - fix(client): preserve headers when csrfFetch is called with a Request object

  csrfFetch previously only read headers from the init argument, so when it was called with a full Request object (e.g. csrfFetch(new Request(url, { headers }))), the Request's headers were stripped. It now merges headers from the Request, then the init argument, then the CSRF headers (CSRF headers always take precedence), making csrfFetch a drop-in replacement for fetch.

  Fixes Bug: csrfFetch strips headers when the first argument is a Request #49

• #52 440e0af Thanks @muneebs! - chore(deps): patch transitive dev dependency security advisories

  Bumps pnpm overrides for vite (^6.4.1 → ^6.4.2) and unhead (>=2.1.11 → >=2.1.13) to pull in patched versions. These are dev/build-time dependencies only — no runtime behavior or published API changes.

  Addresses:

  • GHSA: Vite arbitrary file read via dev server WebSocket (high, <=6.4.1)
  • GHSA: Vite path traversal in optimized deps .map handling (medium, <=6.4.1)
  • GHSA: Unhead hasDangerousProtocol() bypass via leading-zero padded HTML entities in useHeadSafe() (medium, <2.1.13)

• Updated dependencies [440e0af]:

  • @csrf-armor/core@1.2.3