Version Packages

apps/cli/CHANGELOG.md

@@ -1,5 +1,30 @@
 # executor
 
+## 1.5.19
+
+### Patch Changes
+
+- [#1115](https://github.com/RhysSullivan/executor/pull/1115) [`92bd86c`](https://github.com/RhysSullivan/executor/commit/92bd86cb975ce867b3002ae9bcb6bf60da67cc48) Thanks [@RhysSullivan](https://github.com/RhysSullivan)! - Google media downloads (Drive file contents, exports, and other binary
+  endpoints) are now returned as binary responses instead of being decoded as
+  text, so files come back intact. Emit them with `emit(result.data)`.
+
+- [#1115](https://github.com/RhysSullivan/executor/pull/1115) [`92bd86c`](https://github.com/RhysSullivan/executor/commit/92bd86cb975ce867b3002ae9bcb6bf60da67cc48) Thanks [@RhysSullivan](https://github.com/RhysSullivan)! - The CLI now validates that a URL is `http`/`https` before handing it to the
+  operating system's browser opener, and on Windows opens it via
+  `rundll32 url.dll,FileProtocolHandler` instead of `cmd /c start`. This removes a
+  path where a crafted URL could be interpreted as a shell command. `executor
+login` and the "open in browser" prompts behave the same for normal URLs.
+
+- [#1115](https://github.com/RhysSullivan/executor/pull/1115) [`92bd86c`](https://github.com/RhysSullivan/executor/commit/92bd86cb975ce867b3002ae9bcb6bf60da67cc48) Thanks [@RhysSullivan](https://github.com/RhysSullivan)! - Hardened the hosted egress guard. Outbound requests from OAuth token exchanges,
+  MCP transports, and GraphQL/Google/Microsoft discovery now all route through the
+  guard, and the guard resolves DNS before connecting so a hostname that points at
+  a private or loopback address is blocked rather than only literal private IPs.
+  This tightens SSRF protection for hosted and cloud execution.
+- Updated dependencies []:
+  - @executor-js/sdk@1.5.19
+  - @executor-js/runtime-quickjs@1.5.19
+  - @executor-js/local@1.4.4
+  - @executor-js/api@1.4.39
+
 ## 1.5.18
 
 ### Patch Changes

apps/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "executor",
-  "version": "1.5.18",
+  "version": "1.5.19",
   "private": true,
   "bin": {
     "executor": "./bin/executor.ts"

apps/cloud/CHANGELOG.md

@@ -1,5 +1,26 @@
 # @executor-js/cloud
 
+## 1.4.37
+
+### Patch Changes
+
+- Updated dependencies []:
+  - @executor-js/sdk@1.5.19
+  - @executor-js/runtime-quickjs@1.5.19
+  - @executor-js/execution@1.5.19
+  - @executor-js/plugin-graphql@1.5.19
+  - @executor-js/plugin-mcp@1.5.19
+  - @executor-js/plugin-openapi@1.5.19
+  - @executor-js/api@1.4.39
+  - @executor-js/vite-plugin@0.0.36
+  - @executor-js/cloudflare@0.0.18
+  - @executor-js/host-mcp@1.4.4
+  - @executor-js/runtime-dynamic-worker@1.4.4
+  - @executor-js/plugin-google@1.5.18
+  - @executor-js/plugin-microsoft@1.5.18
+  - @executor-js/plugin-workos-vault@0.0.2
+  - @executor-js/react@1.4.39
+
 ## 1.4.36
 
 ### Patch Changes

apps/cloud/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@executor-js/cloud",
-  "version": "1.4.36",
+  "version": "1.4.37",
   "private": true,
   "type": "module",
   "scripts": {

apps/desktop/CHANGELOG.md

@@ -1,5 +1,7 @@
 # @executor-js/desktop
 
+## 1.5.19
+
 ## 1.5.18
 
 ## 1.5.17

apps/desktop/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@executor-js/desktop",
-  "version": "1.5.18",
+  "version": "1.5.19",
   "private": true,
   "homepage": "https://github.com/RhysSullivan/executor",
   "license": "MIT",

apps/host-selfhost/CHANGELOG.md

@@ -1,5 +1,24 @@
 # @executor-js/host-selfhost
 
+## 0.0.18
+
+### Patch Changes
+
+- Updated dependencies []:
+  - @executor-js/sdk@1.5.19
+  - @executor-js/runtime-quickjs@1.5.19
+  - @executor-js/execution@1.5.19
+  - @executor-js/plugin-graphql@1.5.19
+  - @executor-js/plugin-mcp@1.5.19
+  - @executor-js/plugin-openapi@1.5.19
+  - @executor-js/app@1.4.4
+  - @executor-js/api@1.4.39
+  - @executor-js/host-mcp@1.4.4
+  - @executor-js/plugin-encrypted-secrets@0.0.18
+  - @executor-js/plugin-google@1.5.18
+  - @executor-js/plugin-microsoft@1.5.18
+  - @executor-js/react@1.4.39
+
 ## 0.0.17
 
 ### Patch Changes

apps/host-selfhost/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@executor-js/host-selfhost",
-  "version": "0.0.17",
+  "version": "0.0.18",
   "private": true,
   "type": "module",
   "exports": {