[dependabot]

Bumps the compatible-packages group with 4 updates: @caveman-ai/cli, ai, hyperframes and parse5.

Updates @caveman-ai/cli from 4.0.1 to 4.1.0

Release notes

Sourced from @​caveman-ai/cli's releases.

bin-v4.1.0

Signed Caveman runtime companions for macOS, Linux, and Windows. The binaries are licensed under the Apache License 2.0 (LICENSE, NOTICE); see LICENSING.md and the attached third-party notices. The ghcr.io caveman-proxy image is still built without cgo, so its code compressor handles Go source only; the caveman-proxy and caveman-engine binaries here also compress TypeScript, JavaScript, Python, Rust, Java and C/C++.

Caveman 4.1.0 is a maintenance release: bug fixes across compress, OpenCode, Hermes, Pi, the proxy and the hooks, a recovery store that no longer fills up and stops compressing, and a few small switches people asked for. caveman-compress now refuses a file with a key or token in it, and installs from skill hubs again.

Action needed

• forward_headers under a providers.<name> block now stops the proxy from starting. Before, it was silently ignored: no headers were forwarded and the only symptom was an upstream 401. Configure that upstream as a compat mount instead: compat.<name> with base_url and forward_headers, plus wire_dialect: anthropic if it speaks the Anthropic protocol (see docs/technical/configuration.md) (#1458).
• caveman-compress refuses a file whose text holds a credential, such as a private key block or a cloud, Git host or model API token. Compression sends the file to your model provider, so move the secret into an env var or secret manager first. The error names the line, never the secret. Placeholders like sk-... or $OPENAI_API_KEY still compress (#1471).

Changed

• Old recovery handles can now expire. The recovery store used to keep every compressed original forever, so it filled up and compression stopped (#1370). When a write would exceed the store's cap, it now frees room: typed objects of sessions idle 14 days (archived) or 30 days (any) are expired, oldest first, until the store is at 80%. Retrieving an expired handle answers cave_expired_recovery, and each expiry is logged in proxy.log. Blob recoveries never expire (#1481).

New

• caveman-proxy recovery-store status|check|repair for a damaged ccr.db. A damaged store now refuses writes instead of staying corrupt across upgrades; reads keep working. Repair copies only rows whose bytes still match their hash, and moves the damaged files aside untouched. caveman status and caveman doctor point at it (#1369, #1481).

• Turn off the per-prompt reminder with CAVEMAN_REINFORCE=0, or "reinforce": false in ~/.config/caveman/config.json or a repo's .caveman.json. The full ruleset is still sent at session start (#1468).

• --hook-node node makes installed hooks find Node through PATH at run time instead of pinning the install-time path, for people who switch Node versions (#1452). The default is unchanged, because apps started outside a terminal don't see the shell's PATH.

• The installer falls back to Bun when Node is absent. Node stays first (#570, #1344 by @​cyrus-za).

• caveman learn scans Pi sessions, and honors PI_CODING_AGENT_DIR / PI_CODING_AGENT_SESSION_DIR (#1317 by @​tranducquy0).

• caveman mem can revert a memory to an earlier value, and supersede --stdin takes replacements too large for a command line (#1386 by @​PARTHDESHMUKH2005). The client checks that the installed binary supports --stdin first, so an older binary can no longer store the literal text --stdin as the fact.

Fixed

caveman-compress

• Hermes' skill hub blocked the install with a DANGEROUS verdict that --force can't override. Every finding was a false match, and the matched text is respelled with identical behavior (#1464).
• Backups are keyed on the file's full path, so two projects' CLAUDE.md no longer share one backup slot. A run that dies before writing removes its backup and staging file, so the next run doesn't abort.
• Validation now refuses commentary appended after the body (#1433). The prompt keeps the verb that carries an instruction (#1434). Frontmatter stays local on both passes (#1359 by @​leninworld). Trailing punctuation on URLs and paths no longer fails validation (#1356 by @​Pharex38). Credential dotfiles and bare dotfiles like .env are refused by name (#1357 by @​Pharex38, #1363).

OpenCode

• OpenCode 2: the shrink plugin is generated for the API the installed major actually loads (#1445). OPENCODE_CONFIG_DIR is honored everywhere (#1441). Deleted sessions are acted on (#1444), and the host's project directory is passed through (#1443).
• The installer's already-installed probe reads JSONC settings.json correctly, and the plugin honors a repo defaultMode: "off" (#1430, #1431 by @​Quinnod345).

Hermes

• caveman enable hermes writes YAML that still parses (#1405). It reads ownership by value, so a reformatted config stays owned (#1410). It honors plugins.enabled / plugins.disabled membership (#1442, #1446 by @​Ha1baraA11).

Pi (@caveman-ai/pi 0.3.2)

• Per-prompt context is sent as a message, so the provider's prompt cache survives each prompt (#1364, #1376 by @​worldofgeese).
• Tool outputs under 4 KB are no longer replaced by a retrieval handle (#1365, #1378 by @​danieldutu). caveman_retrieve with a query now says it returns an excerpt (#1368, #1377 by @​danieldutu).
• Pi's virtual router/auto model no longer warns that it is unroutable (#1449). The compat route is verified for an OpenAI base URL without /v1 (#1325 by @​szsunyuan).

Proxy, stats and cost

• Claude Code requests that declare the advisor tool are priced again, instead of every request showing "Unknown" cost (#1465). Streaming Anthropic responses read their outcome qualifiers from the right place (#1453).
• A completed Codex stream closed by the client keeps its token counts (#1397, #1398 by @​Ha1baraA11).
• caveman start reads the proxy's top-level mode, not a nested middleware.mode (#1457).
• A compat upstream blocked by the SSRF guard now answers cave_upstream_blocked and logs the host plus the CAVE_SSRF_ALLOWLIST fix, instead of a generic 502 (#1440).
• caveman stats no longer times out on large stores: per-request cache digests moved to their own table, migrated in the background (#1371, #1481). On a timeout it names the database size and suggests --days 7.
• Native runtime: CCR writes no longer re-scan the whole store, which in large homes made native requests run out their 250 ms budget and close empty (#1279). Overlong native.sock paths are reported (#1399, #1402 by @​Ha1baraA11).

... (truncated)

Commits

• c310c9d Merge pull request #1476 from JuliusBrussee/release/4.1.0
• fe09506 Merge pull request #1479 from JuliusBrussee/maint/npm-deps
• 6852cf1 Merge origin/main into release/4.1.0
• 46d3d88 Merge origin/main into maint/npm-deps
• 3c28af7 Merge origin/main into maint/ccr-store
• 4021d43 Merge pull request #1474 from JuliusBrussee/maint/pins-deps
• e82af5b Merge pull request #1477 from JuliusBrussee/maint/integrations
• a52cd75 fix(cli): say when the recovery store stops compression, and why
• d679959 chore(deps): bump the npm dev group with lockfiles that install
• 0ad8e60 fix(codex): avoid invalid PostCompact hook output
• Additional commits viewable in compare view

Updates ai from 7.0.164 to 7.0.165

Changelog

Sourced from ai's changelog.

7.0.165

Patch Changes

• 883fcde: remove transcription word timings from telemetry when recordOutputs is false
• 6d21e8e: Sanitize provider request URLs before text generation results reach telemetry integrations and tracing subscribers, preventing endpoint credentials from being exposed.
• Updated dependencies [6400cf8]
• Updated dependencies [f608c05]
• Updated dependencies [cab9c1f]
• Updated dependencies [c70adf6]
  • @​ai-sdk/provider-utils@​5.0.76
  • @​ai-sdk/provider@​4.0.37
  • @​ai-sdk/gateway@​4.0.138

Commits

• 0f3a85f Version Packages (#24672)
• 6d21e8e fix(ai): sanitize request URLs before telemetry observes provider results (#2...
• f608c05 fix(provider-utils): reject HTTPS download downgrades (#24680)
• 883fcde fix(ai): hide transcription words from telemetry when recordOutputs is false ...
• c70adf6 fix(typesafe-ai): align decision API with OpenAPI (#24627)
• See full diff in compare view

Updates hyperframes from 0.9.20 to 0.9.23

Release notes

Sourced from hyperframes's releases.

v0.9.23

HyperFrames v0.9.23

Released on 2026-11-08.

Fade-ins that follow a starting set now end fully visible instead of vanishing when the fade finishes. Failed script reports also name their library, and menu highlights match their panel.

Features

• Engine: A failed CDN script's report names its library and version, never its URL (adf14d732, #7394).
• Core: Preview health names the media element that held play (fd05a3860, #7159).

Fixes

• Core: A set written before its tween no longer erases the tween's end (75fe18c62, #7397).
• Studio: A menu row's highlight is rounder than its panel (ab785e9c5, #7395).
• Studio: Bound recovery and verify full-quality playback (3151fd213, #7393).

Internal

• Engine: The decode timeout warning reaches every caller (0f5914dc4, #7119).

Full changelog

heygen-com/hyperframes@v0.9.22...v0.9.23

v0.9.22

HyperFrames v0.9.22

Released on 2026-11-08.

Studio previews look sharper: scrubbing shows full-quality decoded frames, and seeking no longer drops to an incomplete picture. Renders also keep page timers on the film's schedule at any worker count.

Features

• Studio: Scrub full-quality video with decoded preview frames (b7157bdab, #7379).

Fixes

• Producer: Keep page timers on the film's schedule at every worker count (fed14b016, #7390).
• Core: Retain complete preview pictures during native seeks (b87a01f6a, #7378).

Internal

• Producer: The injector budget test no longer leaves a no-op injector for later tests (34118d8f2, #7384).

Full changelog

heygen-com/hyperframes@v0.9.21...v0.9.22

... (truncated)

Commits

• 7ad2be9 chore: release v0.9.23 (#7399)
• 26956ea chore: release v0.9.22 (#7392)
• a0bbaab chore: release v0.9.21 (#7385)
• e0c11bf fix(cli): a media file referenced by its filesystem path goes into the cloud ...
• 7b79ab4 fix(check): lint and check skip compositions the project never mounts (#7369)
• 3d7f12a feat(cli): cloud uploads send a big file in parts, so a cut connection resend...
• 57a7533 fix(cli): a re-encode of a media file over the cap is limited to fit it (#7376)
• b418bb2 refactor(cli): the cloud upload's PUT and retry code moves to its own file (#...
• 9efbbdf fix(cli): transcribe names why whisper is missing and the one line that fixes...
• a3b8f52 fix(check): masked or clipped-away text no longer counts as overlapping (#7364)
• Additional commits viewable in compare view

Updates parse5 from 8.1.0 to 8.1.1

Release notes

Sourced from parse5's releases.

v8.1.1

This release fixes nineteen security-relevant issues in the tokenizer, serializer, SAX parser, rewriting stream, tree adapters and tree construction, reported by outside researchers and by Anthropic, and further issues of the same kinds found while reviewing them. The issues include crashes from a few bytes of input, parse time and memory far out of proportion to the input, and serializer output that re-parses into markup the parsed tree did not contain. Everyone who runs parse5 on untrusted input should update.

There are no CVEs or GitHub security advisories for these issues: private vulnerability reporting on this repository is only accessible to @​inikulin. The current maintainers cannot access it, so the reports could not be filed or published as advisories here.

Security fixes

• 9b57bf87 High: a crash from two code units. A lone low surrogate followed by another low surrogate was decoded as a pair, and String.fromCodePoint then threw out of every parser entry point. Only a high surrogate now starts a pair. Reported by Joshua Rogers and by Anthropic.
• 98a4bb34 High: a crash, also through cheerio's $.html(). Serialization recursed once per DOM level, so a few KB of nesting exhausted the call stack. It now uses an explicit stack, and the output is unchanged byte for byte. Reported by SnailSploit.
• ea240155 High: quadratic parse time. The SAX parser's namespace stack was shifted from the front for every element, quadratic in the nesting. It is kept at its tail. Reported by iaohkut, José Antonio Zamudio Amaya and Ravindu Lakmina.
• fa1eb9b0 High: a crash, and quadratic time before it. Nested templates were closed recursively at EOF, and the template insertion-mode stack was shifted per template. Both are iterative now. Reported by SnailSploit and by the three reporters above.
• 20591465 High: quadratic parse time. Foster parenting scanned all preceding siblings of the table for every insertion. The reference is found without scanning. Reported by iaohkut, José Antonio Zamudio Amaya and Ravindu Lakmina.
• 6c705d57 High: 8,002,000 attribute records from 39 KB of input. Integration-point checks read the attribute list of every element, which the htmlparser2 adapter allocates on each call. Only annotation-xml needs it, and its list is now read once per element, as the HTML Standard decides by the start tag (rereading it on every pop took 7 s for 8,000 attributes and children; a script that edits encoding mid-parse no longer changes the verdict, stated in the commit). Reported by Anthropic; the rereads on every pop were found while reviewing this series.
• 0a61bd54 High: 210 ms from 35 KB, growing quadratically. adoptAttributes rebuilt the recipient's name Set for an empty merge, so repeated <html> and <body> tags without attributes were quadratic. It returns early. Tags that each add an attribute rebuilt it too (816 ms for 8,000 <html> tags), so the adapter now keeps the names between merges and re-indexes when the list changed under it; a script that renames an attribute between two merges to a name the cache has never seen is the one documented difference (stated in the commit). Reported by iaohkut, José Antonio Zamudio Amaya and Ravindu Lakmina; the merges that add attributes were found while reviewing this series.
• 89dceda8 High: a crash and mutation XSS. Resetting the insertion mode matched foreign elements by tag id, so an SVG select or template selected an HTML mode; a TypeError followed from 50 bytes, and a longer shape serialized into an <img onerror> absent from the tree. Foreign elements are skipped. Reported by Anthropic.
• f5d58d8f High: quadratic parse time from formatting tags. Formatting tags with distinct attributes (<b a=1><b a=2>…) made every insertion into the list of active formatting elements scan the list for Noah's Ark, and formatting end tags scanned and spliced it. The list is now linked and indexed by tag and by attributes, so insertion costs the tag's attributes and removal and lookup are constant. An attribute group leaves the index with its last entry, so the index does not grow with the distinct attribute sets of the input. Reported by Liyi Zhou, Ziyue Wang, Strick Sheng, Maurice Ng and Chenchen Yu (University of Sydney), and by Anthropic.
• e2901d06 High: 13–18 s from 300 KB, also through cheerio's .append(), .html() and $(). Moving a node's children (every parseFragment result out of its root, the adoption agency's furthest block) detached them one at a time from the front of the child list, quadratic in their number. The children are copied once, detached from the end and appended in order, and both bundled adapters check the last child before searching the list, as insertBefore already did; the adapter interface is unchanged. parseFragment of 100,000 <b></b>: 4.1 s → 45 ms. Reported by Anthropic.
• fcce48d0 High: the reported deep-nesting quadratic. Every search of the stack of open elements cost up to its depth per token: scope checks, list items, generic end tags, insertion-mode resets, end tags in foreign content, foster parenting and the adoption agency's up to eight passes per end tag. 391 KB of nested <div>s took 23.7 s, and 256 repetitions of <b>, 255 <span><div> pairs and 33 </b> took 17.2 s from 735 KB. Once 64 elements are open, the stack indexes them by tag and counts the special elements and scope boundaries at or below each, so every search is constant per token, and the adoption agency leaves a removed element's slot free instead of shifting the stack; the two documents take 39 ms and 104 ms. Stacks that never reach 64 elements are scanned as before; a stack that does keeps the index for the rest of the parse and pays for it on every push and pop (300 nested tables parse about 20% slower). Reported by iaohkut, José Antonio Zamudio Amaya and Ravindu Lakmina; the adoption-agency and foreign-content cases were found while reviewing this series.
• #1922 High: quadratic tokenizer time from a tag with many attributes. The duplicate-attribute check compared every new name with every earlier one; tags with more than 64 attributes now use a set. Reported by SameerJS6 in #1901.
• 53d1261c Medium: a script-stripping rewriter misses a script. When the parsed chunk was dropped between the two code points of a character reference, input after the reference was skipped: no tag events for it, while RewritingStream forwarded its raw bytes. The position is recomputed from the current buffer. Reported by Anthropic.
• 4bffbe64 Medium: a filter bypass once the output is embedded in a page. At EOF inside a tag, the pending text's source range covered the dropped tag, so RewritingStream forwarded an unfinished tag that no listener saw. The text now ends where the tag starts. Reported by Anthropic.
• e02abba4 Medium: XSS through the rewriter. RewritingStream#emitText chose raw output from lastStartTagName, so text after </script>, before <script> or in an SVG <style> was written unescaped and entity-encoded input became live markup. It now tracks inRawText from the tokenizer state. Reported by Joshua Rogers and by Anthropic.
• ac2f60d5 Medium: memory proportional to an uncapped stream. The streaming parsers kept a whole run of text as one pending token until a tag; memory grew with the stream. Completed text is flushed when a parsed chunk is dropped, with exact source ranges, in every state without an unfinished token, so a stream whose every chunk ends inside a CDATA ]], a named reference or an escaped-script < is flushed too and only the pending construct stays buffered. Reported by Liyi Zhou, Ziyue Wang, Strick Sheng, Maurice Ng and Chenchen Yu (University of Sydney); the chunks ending in a delimiter or reference were found while reviewing this series.
• fd22254c Medium: mutation XSS. The adoption agency acted on an older formatting element behind a scope boundary and moved the boundary element; the serialized tree re-parsed into an <img> absent from the input. It runs on the identified element. Reported by Anthropic.
• 61676e2b Medium, for consumers that inspect parse5's tree and forward the original bytes. Implied end tags popped foreign elements, so a </form> closed an SVG rp and parse5 read raw text where browsers see an <img onerror>. HTML elements only. Reported by Anthropic.
• b9093da5 Medium, same consumer pattern. Foreign end tags were matched with toLowerCase, which folds U+212A KELVIN SIGN to k; the wrong ancestors stayed open and parse5 hid an <img> browsers render. Matching is ASCII case-insensitive. Reported by Anthropic.
• 69f69313 Medium, same consumer pattern. In a fragment, an unmatched foreign end tag was dropped at the root instead of being processed with the HTML rules, so a </form> did not reset the form pointer and a later <form action=javascript:…> was missing from the fragment. Reported by Anthropic.
• d5f4f129 Medium, same consumer pattern. A fragment context's SVG form ancestor was taken as the form element pointer, suppressing the fragment's HTML form. Only an HTML form qualifies. Found while reviewing this series.
• 48aba8cb Low: a self-closing <svg/> or <math/> left its namespace frame in the SAX simulator, so a stream of such roots grew the frame stack without bound and following content was tokenized as foreign; integration-point end tags now close only the frame their element opened. Frames also follow tree construction for svg and math inside the other foreign namespace, mglyph and malignmark in a MathML text integration point, and </p> and </br>. Found while reviewing this series.
• f52fa37f Documentation. SECURITY.md now says that the current maintainers cannot see reports filed through GitHub's private vulnerability reporting, and that Tidelift is the only channel for reports.

Other changes

• docs: add usage examples for four parse5 packages by @​Sinkleberg in inikulin/parse5#1878
• fix(plain-text): default to the standard tree adapter types by @​xiehuanyi in inikulin/parse5#1883
• fix(parser-stream): require parse5 ^8.1.0 by @​scttcper in inikulin/parse5#1916
• chore: v8.1.1 by @​fb55 in inikulin/parse5#1926

New Contributors

• @​Sinkleberg made their first contribution in inikulin/parse5#1878
• @​xiehuanyi made their first contribution in inikulin/parse5#1883
• @​scttcper made their first contribution in inikulin/parse5#1916

Packages

parse5 8.1.1, parse5-sax-parser 8.0.1, parse5-html-rewriting-stream 8.1.1, parse5-htmlparser2-tree-adapter 8.0.2, parse5-parser-stream 8.1.1, parse5-plain-text-conversion-stream 8.0.1. The dependent packages require the fixed parse5.

Full Changelog: inikulin/parse5@v8.1.0...v8.1.1

Commits

• 8eea616 chore: v8.1.1 (#1926)
• fcce48d perf(parser): find open elements without scanning a deep stack
• e2901d0 perf(parser): move children between nodes without shifting the list
• f5d58d8 perf(parser): find and remove formatting list entries in constant time
• 48aba8c fix(sax-parser): enter and leave foreign namespaces where tree construction does
• f52fa37 docs(security): name Tidelift as the only channel for reports
• d5f4f12 fix(parser): ignore a foreign form ancestor of the fragment context
• 69f6931 fix(parser): process unmatched foreign end tags at the root of a fragment
• b9093da fix(parser): match foreign end tags ASCII case-insensitively
• 61676e2 fix(parser): generate implied end tags for HTML elements only
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by fb55, a new releaser for parse5 since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions