Merge tag '0.4.2'

BotKit 0.4.2

Author: dahlia

.github/workflows/main.yaml

@@ -63,7 +63,7 @@ jobs:
         node-version: "22"
     - uses: pnpm/action-setup@v4
       with:
-        version: latest
+        version: 10
     - if: github.ref_type == 'branch'
       run: |
         set -euo pipefail

CHANGES.md

@@ -7,6 +7,20 @@ Version 0.5.0
 To be released.
 
 
+Version 0.4.2
+-------------
+
+Released on May 21, 2026.
+
+### @fedify/botkit
+
+ -  Upgraded Fedify to 2.1.14 to fix a security vulnerability in Linked Data
+    Signature verification that could allow certain signed activities to be
+    interpreted differently than intended.  [[CVE-2026-42462]]
+
+[CVE-2026-42462]: https://github.com/fedify-dev/fedify/security/advisories/GHSA-9rfg-v8g9-9367
+
+
 Version 0.4.1
 -------------
 
@@ -86,6 +100,16 @@ Released on March 30, 2026.
 [#19]: https://github.com/fedify-dev/botkit/pull/19
 
 
+Version 0.3.3
+-------------
+
+Released on May 21, 2026.
+
+ -  Upgraded Fedify to 1.9.11 to fix a security vulnerability in Linked Data
+    Signature verification that could allow certain signed activities to be
+    interpreted differently than intended.  [[CVE-2026-42462]]
+
+
 Version 0.3.2
 -------------
 

deno.json

@@ -2,10 +2,10 @@
   "workspace": ["packages/*", "examples/*"],
   "unstable": ["kv", "temporal"],
   "imports": {
-    "@fedify/denokv": "jsr:@fedify/denokv@2.1.12",
-    "@fedify/fedify": "jsr:@fedify/fedify@2.1.12",
-    "@fedify/vocab": "jsr:@fedify/vocab@2.1.12",
-    "@fedify/vocab-runtime": "jsr:@fedify/vocab-runtime@2.1.12",
+    "@fedify/denokv": "jsr:@fedify/denokv@2.1.14",
+    "@fedify/fedify": "jsr:@fedify/fedify@2.1.14",
+    "@fedify/vocab": "jsr:@fedify/vocab@2.1.14",
+    "@fedify/vocab-runtime": "jsr:@fedify/vocab-runtime@2.1.14",
     "@logtape/logtape": "jsr:@logtape/logtape@^1.3.5",
     "@std/fs": "jsr:@std/fs@^1.0.19",
     "@std/path": "jsr:@std/path@^1.1.1",