Activity

Summary

Cuts v2.9.0 bundling everything merged since v2.8.1.

Minor bump because env vars masking (#182) is a user-visible behavioural change — callers that relied on plaintext value in env_vars list responses must now pass reveal: true.

What's in it

• Security: env vars masked by default (#182, closes #159) — value and real_value replaced with ***, opt-in reveal: true for explicit reads. Both summary and full projections covered.
• Fix: env var field names match Coolify API (#174, closes #135) — is_build_time → is_buildtime, plus new is_runtime flag. Previous name was being rejected (422) or silently dropped by Coolify v4.
• Fix: defensive parsing for non-JSON / malformed responses (#177, closes #163) — request<T>() falls back to raw text on parse failure, fixes /api/v1/version plaintext breakage on Coolify 4.0.0-beta.474.
• Internal: dependabot now ignores TypeScript major bumps (#179), dep bumps from #170/#176/#180/#181.

Triggers npm publish

Merging this changes package.json on main, which the publish.yml workflow watches — @masonator/[email protected] will publish to npm via trusted publishing.

Test plan

• All 297 tests green
• Prettier check clean on CHANGELOG / package.json / package-lock.json
• Coverage stable (98.79% lines on coolify-client.ts)
• Confirm npm publish succeeds after merge