Sourced from getsentry/craft's releases.

2.26.6

Bug Fixes 🐛

• (nuget) Move global.json aside during dotnet setversion by @​jamescrosswell in #820
• (security) Override @​tootallnate/once to ^2.0.1 (CVE-2026-3449) by @​BYK in #822
• Improve partial publishing recovery for CocoaPods and GitHub targets by @​BYK in #821

2.26.5

Bug Fixes 🐛

• (security) Bump devalue override to ^5.8.1 (CVE-2026-42570) by @​BYK in #818

2.26.4

Bug Fixes 🐛

• (security) Prevent script injection in changelog-preview workflow by @​fix-it-felix-sentry in #813
• Resolve open dependabot security alerts by @​BYK in #816

Internal Changes 🔧

• (deps-dev) Bump simple-git from 3.33.0 to 3.36.0 by @​dependabot in #814

2.26.3

Bug Fixes 🐛

• Prevent shell injection vulnerabilities in GitHub Actions workflows by @​fix-it-felix-sentry in #811

Sourced from getsentry/craft's changelog.

Changelog

2.26.6

Bug Fixes 🐛

• (nuget) Move global.json aside during dotnet setversion by @​jamescrosswell in #820
• (security) Override @​tootallnate/once to ^2.0.1 (CVE-2026-3449) by @​BYK in #822
• Improve partial publishing recovery for CocoaPods and GitHub targets by @​BYK in #821

2.26.5

Bug Fixes 🐛

• (security) Bump devalue override to ^5.8.1 (CVE-2026-42570) by @​BYK in #818

2.26.4

Bug Fixes 🐛

• (security) Prevent script injection in changelog-preview workflow by @​fix-it-felix-sentry in #813
• Resolve open dependabot security alerts by @​BYK in #816

Internal Changes 🔧

• (deps-dev) Bump simple-git from 3.33.0 to 3.36.0 by @​dependabot in #814

2.26.3

Bug Fixes 🐛

• Prevent shell injection vulnerabilities in GitHub Actions workflows by @​fix-it-felix-sentry in #811

2.26.2

Security 🔒

• (deps) Bump uuid to ^14.0.0 (fix GHSA-w5hq-g745-h8pq) by @​BYK in #810

Bug Fixes 🐛

• (prepare) Remove --allow-remote-config gate by @​BYK in #809

Internal Changes 🔧

• (deps) Bump astro from 5.18.1 to 6.1.6 in /docs by @​dependabot in #806
• (deps-dev) Bump fast-xml-parser from 5.5.7 to 5.7.0 by @​dependabot in #808

2.26.1

... (truncated)

• 3e6a0f4 release: 2.26.6
• 2662e81 fix(security): override @​tootallnate/once to ^2.0.1 (CVE-2026-3449) (#822)
• e9a5238 fix: improve partial publishing recovery for CocoaPods and GitHub targets (#821)
• da0e0c1 fix(nuget): move global.json aside during dotnet setversion (#820)
• d1fa7db meta: Bump new development version
• ca52417 Merge branch 'release/2.26.5'
• bc2e6a9 release: 2.26.5
• 60b80e5 fix(security): bump devalue override to ^5.8.1 (CVE-2026-42570) (#818)
• 7bd2931 meta: Bump new development version
• 1389909 Merge branch 'release/2.26.4'
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)