Hashery
← Back to Changelog

v3.0.5

Release
October 18, 2026

[email protected] — 2026-10-18

This release patches vulnerable dependency versions and adds a review badge.

Bug Fixes

  • security - upgrade vulnerable dependency versions (#105)

    The lockfile moves these packages to patched releases on the same major line:

    • brace-expansion 1.1.12 -> 1.1.21. The new release fixes CVE-2026-13149, CVE-2026-102276, CVE-2026-33750, CVE-2026-14257, CVE-2026-102277, CVE-2026-102278, and CVE-2026-69152.
    • brace-expansion 5.0.2 -> 5.0.12. The new release fixes CVE-2026-13149, CVE-2026-102276, CVE-2026-33750, CVE-2026-45149, CVE-2026-14257, CVE-2026-102277, CVE-2026-102278, and CVE-2026-69152.
    • esbuild drops 0.25.12. Releases 0.28.1 and 0.28.2 remain.
    • handlebars 4.7.9 -> 4.7.10. The new release fixes CVE-2026-106445 and CVE-2026-106446.
    • hookified 3.0.3 -> 3.0.4. Releases 1.15.1 and 2.2.0 remain.
    • minimatch 10.2.0 -> 10.2.6. Release 3.1.5 remains. The new release fixes CVE-2026-26996, CVE-2026-27903, and CVE-2026-27904.
    • nanoid 3.3.11 -> 3.3.20. The new release fixes CVE-2026-67214, CVE-2026-67213, and CVE-2026-73086.
    • postcss 8.5.10 -> 8.5.29. The new release fixes CVE-2026-45623, CVE-2026-69153, and CVE-2026-73646.
    • source-map-js 1.2.1 -> 1.2.2. The new release fixes CVE-2026-93749.
    • undici 7.29.0 and 7.29.1 -> 7.30.0. Release 8.10.2 remains. An override pins undici@7 to 7.30.0. The 7.30.0 release fixes CVE-2026-19534, CVE-2026-84961, CVE-2026-84947, CVE-2026-84933, and CVE-2026-85024. It also fixes CVE-2026-84890, CVE-2026-85008, CVE-2026-18149, CVE-2026-18540, and CVE-2026-85014.
    • vite 7.2.2 -> 7.3.7. The manifest adds vite ^7.3.7 as a direct devDependency. The new release fixes CVE-2026-39365, CVE-2026-53571, CVE-2026-39363, CVE-2026-39364, and CVE-2026-53632.

    These @esbuild platform packages also drop 0.25.12. Releases 0.28.1 and 0.28.2 remain:

    • @esbuild/aix-ppc64
    • @esbuild/android-arm
    • @esbuild/android-arm64
    • @esbuild/android-x64
    • @esbuild/darwin-arm64
    • @esbuild/darwin-x64
    • @esbuild/freebsd-arm64
    • @esbuild/freebsd-x64
    • @esbuild/linux-arm
    • @esbuild/linux-arm64
    • @esbuild/linux-ia32
    • @esbuild/linux-loong64
    • @esbuild/linux-mips64el
    • @esbuild/linux-ppc64
    • @esbuild/linux-riscv64
    • @esbuild/linux-s390x
    • @esbuild/linux-x64
    • @esbuild/netbsd-arm64
    • @esbuild/netbsd-x64
    • @esbuild/openbsd-arm64
    • @esbuild/openbsd-x64
    • @esbuild/openharmony-arm64
    • @esbuild/sunos-x64
    • @esbuild/win32-arm64
    • @esbuild/win32-ia32
    • @esbuild/win32-x64

Documentation

  • Add the Drydock review badge to the readme (#104)

Contributors

  • @jaredwray (2)

Full List of Changes

  • Add the Drydock review badge to the readme by @jaredwray in #104
  • fix: security - upgrade vulnerable dependency versions by @jaredwray in #105

Full diff: https://github.com/jaredwray/hashery/compare/v3.0.4...v3.0.5