Merge pull request #444 from ckb-devrel/develop

Merge v0.4.8 into master

Author: RetricSu

CHANGELOG.md

@@ -1,5 +1,12 @@
 # @offckb/cli
 
+## 0.4.8
+
+### Patch Changes
+
+- Override `form-data@>=4.0.0 <4.0.6` to `4.0.6` to fix CRLF injection (GHSA).
+- Override `hono@<4.12.25` to `4.12.25` to fix CORS origin reflection with credentials.
+
 ## 0.4.7
 
 ### Patch Changes

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@offckb/cli",
-  "version": "0.4.7",
+  "version": "0.4.8",
   "description": "ckb development network for your first try",
   "author": "CKB EcoFund",
   "license": "MIT",
@@ -25,11 +25,6 @@
   "publishConfig": {
     "access": "public"
   },
-  "pnpm": {
-    "onlyBuiltDependencies": [
-      "secp256k1"
-    ]
-  },
   "scripts": {
     "build": "node scripts/build.js",
     "start": "ts-node-dev --transpile-only src/cli.ts",

pnpm-lock.yaml

@@ -0,0 +1,6 @@
+overrides:
+  "form-data@>=4.0.0 <4.0.6": "4.0.6"
+  "hono@<4.12.25": "4.12.25"
+
+onlyBuiltDependencies:
+  - secp256k1