From ede62ff59c167784c618a44a02d87d0e17ccd502 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Fri, 10 Jul 2026 22:28:38 +0000 Subject: [PATCH] ci(repo): version packages --- .changeset/node-modules-bin-prettier-bug.md | 5 ----- packages/cli/CHANGELOG.md | 6 ++++++ packages/cli/package.json | 2 +- 3 files changed, 7 insertions(+), 6 deletions(-) delete mode 100644 .changeset/node-modules-bin-prettier-bug.md diff --git a/.changeset/node-modules-bin-prettier-bug.md b/.changeset/node-modules-bin-prettier-bug.md deleted file mode 100644 index c38930fe..00000000 --- a/.changeset/node-modules-bin-prettier-bug.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"clerk": patch ---- - -Prevent `clerk init` from executing an attacker-planted `node_modules/.bin/{prettier,biome,skills}` binary from the project being set up. The formatter and skills steps now pin the package runner to the registry (`bunx --package @latest -- …`, and the pnpm/yarn `dlx` equivalents) so it runs the real tool instead of a project-local bin shadow. diff --git a/packages/cli/CHANGELOG.md b/packages/cli/CHANGELOG.md index a9b197b5..069435fa 100644 --- a/packages/cli/CHANGELOG.md +++ b/packages/cli/CHANGELOG.md @@ -1,5 +1,11 @@ # clerk +## 2.0.1 + +### Patch Changes + +- Prevent `clerk init` from executing an attacker-planted `node_modules/.bin/{prettier,biome,skills}` binary from the project being set up. The formatter and skills steps now pin the package runner to the registry (`bunx --package @latest -- …`, and the pnpm/yarn `dlx` equivalents) so it runs the real tool instead of a project-local bin shadow. ([#377](https://github.com/clerk/cli/pull/377)) by [@rafa-thayto](https://github.com/rafa-thayto) + ## 2.0.0 ### Major Changes diff --git a/packages/cli/package.json b/packages/cli/package.json index 92131d57..06553977 100644 --- a/packages/cli/package.json +++ b/packages/cli/package.json @@ -1,6 +1,6 @@ { "name": "clerk", - "version": "2.0.0", + "version": "2.0.1", "private": true, "description": "Clerk CLI", "keywords": [