Bug Fixes 🐛

Deps

• Bump js-yaml to >=4.2.0 to resolve GHSA-h67p-54hq-rp68 by @BYK in #841
• Bump @babel/core to ^7.29.6 to resolve GHSA-4x5r-pxfx-6jf8 by @BYK in #839

Internal Changes 🔧

• Upgrade to Node 24.18.0 (LTS Krypton) by @BYK in #838

Bug Fixes 🐛

• Pin Node to 22.23.1 to avoid node-fetch premature-close regression by @BYK in #837

Bug Fixes 🐛

• Resolve 10 Dependabot security alerts by @BYK in #836

Internal Changes 🔧

• (deps-dev) Bump esbuild from 0.25.12 to 0.28.1 by @dependabot in #834

Bug Fixes 🐛

• Bump shell-quote 1.7.3 → ^1.8.4 (GHSA-w7jw-789q-3m8p) by @BYK in #833

Bug Fixes 🐛

• Replace extract-zip with node-stream-zip to fix Node 24.16.0 hang by @BYK in #831

New Features ✨

• (pypi) Support TWINE_VERBOSE env var to pass --verbose to twine upload by @sentry-junior in #829

Bug Fixes 🐛

• Avoid test timeout in extractZipArchive by batching writes by @BYK in #830

Bug Fixes 🐛

• (nuget) Use unique suffix for global.json backup by @jamescrosswell in #823
• (security) Upgrade vitest to ^4.1.0 and tmp to ^0.2.6 by @BYK in #828

Bug Fixes 🐛

• (nuget) Move global.json aside during dotnet setversion by @jamescrosswell in #820
• (security) Override @tootallnate/once to ^2.0.1 (CVE-2026-3449) by @BYK in #822
• Improve partial publishing recovery for CocoaPods and GitHub targets by @BYK in #821

Bug Fixes 🐛

• (security) Bump devalue override to ^5.8.1 (CVE-2026-42570) by @BYK in #818