5.0.49 (2026-08-14)

Bug Fixes

• adapter-commons: validate query operators nested in arrays (#3700) (304a1aa)

5.0.48 (2026-08-11)

Bug Fixes

• authentication-oauth: allow any port on loopback OAuth origins (#3699) (1a58896), closes #3684

5.0.47 (2026-08-10)

Note: Version bump only for package @feathersjs/feathers

Crow republish: correct compiled builds

Bug Fixes

• release: Republish Crow packages with correctly compiled lib/ from crow source. v4.5.20 accidentally shipped stale Dove builds for some packages (notably @feathersjs/adapter-commons exported AdapterBase instead of AdapterService), which broke feathers-memory and CI.

Notes

• Still includes the @feathersjs/commons prototype-pollution fix from #3695 / GHSA-28xv-ph75-77wh.
• Prefer 4.5.21 over 4.5.20 for all Crow packages.
• prepublishOnly added so modern npm recompiles before publish.

All packages published with dist-tag crow.

@feathersjs/commons@4.5.20 (Crow)

Bug Fixes

• commons: skip prototype-polluting keys in _.merge (#3695)

Backport of GHSA-28xv-ph75-77wh / CVE-2026-54335 (Dove fix: #3690 / 5.0.45).

All Crow packages published as 4.5.20 with dist-tag crow.

5.0.46 (2026-06-27)

Bug Fixes

• mongodb: let objectid keyword fail validation (#3691) (4e312b4)
• Update all dependencies (#3692) (d7e4cc9)

5.0.45 (2026-06-04)

Bug Fixes

• commons: skip prototype-polluting keys in _.merge (#3690) (28b3c03)

5.0.44 (2026-04-02)

Note: Version bump only for package @feathersjs/feathers

5.0.43 (2026-03-21)

Bug Fixes

• authentication-oauth: prevent open redirect via domain suffix attack (#3669) (9905f9f)
• authentication-oauth: Use actual URL origin comparison for origin check (#3676) (32f04d0)
• mongodb: Block $rename operator in _patch data by default (CWE-943) (#3665) (0526ffd)

6.0.0-pre.11 (2026-03-19)

Bug Fixes

• Add CommonJS legacy build for backwards compatibility (#3674) (9d0cdda)
• Add SSE disconnect event (#3673) (b04d785)
• Improve SSE handling and add documentation (#3672) (714792d)

Features

• npm create feathers for v6 (#3654) (358c50e)