|
1 | 1 | # Changelog |
2 | 2 |
|
| 3 | +## Franklin Agent 3.37.0 — the dependency backlog, cleared |
| 4 | + |
| 5 | +**`ws` was never actually declared.** `src/serve/server.ts` imported it while |
| 6 | +`package.json` never listed it — it resolved only because a transitive |
| 7 | +dependency happened to hoist it to the top of `node_modules`. Any shift in that |
| 8 | +dependency's tree, or in npm's hoisting, would have broken `franklin serve` at |
| 9 | +runtime with nothing in CI to catch it. The types were wrong too: `@types/ws` |
| 10 | +was pinned at 7 while ws 8 was what actually ran, which is precisely why the |
| 11 | +`@types/ws` bump 3.35.6 backed out of failed to compile. `ws` is now a real |
| 12 | +dependency at ^8.21.1, the types match reality, and the server uses the named |
| 13 | +`WebSocketServer` export that v8 requires. |
| 14 | + |
| 15 | +**Seven majors taken, each verified on its own terms.** Test coverage alone |
| 16 | +wouldn't have justified any of them, so the runtime-facing ones were exercised |
| 17 | +directly rather than trusted to a green suite: |
| 18 | + |
| 19 | +| upgrade | how it was verified beyond the suite | |
| 20 | +|---|---| |
| 21 | +| typescript 5.9.3 → 7.0.2 | compiled `dist/` with both and diffed the trees — 2 files differ, both cosmetic (quote style in a `.d.ts`, import binding order) | |
| 22 | +| ink 6 → 7 | rendered Franklin's real `VimInput` through the Ink renderer and diffed the frame text | |
| 23 | +| commander 13 → 15 | ran the built CLI: `--version`, root help, subcommand help | |
| 24 | +| @slack/bolt 4 → 5 | checked the exact slice Franklin uses still resolves | |
| 25 | +| sharp 0.34.5 → 0.35.3 | ran read.ts's downscale pipeline on a real 3000x2000 image | |
| 26 | +| @colbymchenry/codegraph 0.9.7 → 1.5.0 | spawned the server and ran a real MCP `initialize` + `tools/list` | |
| 27 | +| @types/node 22 → 26 | type-only | |
| 28 | + |
| 29 | +**Two security findings fixed, the rest are upstream-blocked.** sharp 0.35.3 |
| 30 | +clears the inherited libvips CVEs, which sit on a reachable path — Franklin |
| 31 | +runs user-supplied images through sharp before vision calls. And an override |
| 32 | +keyed on the ws advisory range itself (not on the package name) pulls the |
| 33 | +vulnerable copy `@ethersproject/providers` dragged in, while leaving jayson on |
| 34 | +7.5.13 and viem on 8.21.0 — both already outside the range, so neither eats a |
| 35 | +major for no security gain. High-severity findings drop 8 → 6, total 31 → 29. |
| 36 | +Every remaining one reports `fixAvailable: false`. |
| 37 | + |
| 38 | +**CodeGraph is unpinned.** 1.x added an `exports` map that stopped listing |
| 39 | +`./npm-shim.js`, so resolving that subpath threw even though the file still |
| 40 | +ships as the package's own `bin` — the wall 3.35.6 pinned against. Franklin now |
| 41 | +resolves the manifest (still exported) and walks to the shim beside it. Note |
| 42 | +that 1.5.0 consolidates the old five tools into a single `codegraph_explore`; |
| 43 | +nothing hardcodes those names, since MCP tools are discovered at runtime. |
| 44 | + |
| 45 | +**Two upgrades deliberately declined.** `@polymarket/builder-signing-sdk` 1.0.0 |
| 46 | +type-conflicts with the copy `builder-relayer-client` bundles, and that package |
| 47 | +is already at its latest while still requiring `^0.0.8` — there is no coherent |
| 48 | +pair to move to yet. `@polymarket/clob-client-v2` 1.1.0 builds and passes, but |
| 49 | +it adds a `waitForResolvedTrades` step so `postOrder` now waits on settlement |
| 50 | +transaction hashes before returning. That is live behavior on the |
| 51 | +order-placement path, no local test places a real order, and the module is a |
| 52 | +byte-faithful port that re-syncs with blockrun-mcp — so it stays pinned at |
| 53 | +1.0.8 pending that paired update. |
| 54 | + |
3 | 55 | ## Franklin Agent 3.36.0 — Claude Opus 5 is the default Opus |
4 | 56 |
|
5 | 57 | **`opus` and `claude` now resolve to `anthropic/claude-opus-5`.** It is live on |
|
0 commit comments