Cloud Native Notifications Library

v7.2.1 — 2026-11-01

Security dependency patches and refreshed runtime, tooling, and provider SDK dependencies.

Bug Fixes

• security - bump high-severity dependencies (`0fde27d`, #683)
• depend on axios ^1.20.0 (`ebe2d0b`, #684)
• security - bump follow-redirects and undici (`38d8c14`, #685)
• security - bump zod to 4.6.7 (`fdaf00b`, #686)
• security - bump markdown-it to 15.0.3 (`37b3117`, #687)

Documentation

• add Drydock review badges to package READMEs (`4bffbe8`, #681)

Internal

• drop unused FIREBASE_CERT from CI workflows (`2bfe713`, #680)
• override handlebars and undici (`0e4f4a1`, #682)
• remove axios override (`7942596`, #688)
• remove handlebars override (`0f9d79a`, #689)
• remove zod override (`2765314`, #690)
• upgrade code quality dependencies (`875d9b7`, #691)
• upgrade TypeScript and build tooling (`d2e65e4`, #692)
• upgrade pnpm 12.7.0→12.15.0 (`93d72cb`, #693)
• upgrade GitHub Actions (`ba4341b`, #694)
• upgrade Dev Container image (`31af8b0`, #695)
• upgrade docula 3.0.1→3.0.2 (`bf2d6b7`, #696)
• upgrade AWS SDK clients (`c6a7fe6`, #697)
• upgrade follow-redirects to ^1.16.2 (`ff0a48a`, #698)
• upgrade pingram 1.0.34→1.0.39 (`871a605`, #699)
• upgrade hookified 3.0.4→3.1.0 (`b14c8b2`, #700)
• upgrade twilio 6.1.1→6.2.0 (`b62f83d`, #701)

Contributors

• @jaredwray (22)

Full List of Changes

• mono - chore: drop unused FIREBASE_CERT from CI by @jaredwray in #680
• mono - docs: add Drydock review badges to package READMEs by @jaredwray in #681
• mono - chore: override handlebars and undici by @jaredwray in #682
• mono - fix: security - bump high-severity dependencies by @jaredwray in #683
• twilio - fix: depend on axios ^1.20.0 by @jaredwray in #684
• fix: security - bump follow-redirects and undici by @jaredwray in #685
• fix: security - bump zod to 4.6.7 by @jaredwray in #686
• fix: security - markdown-it 15.0.3 (CVE-2026-111758) by @jaredwray in #687
• mono - chore: remove axios override by @jaredwray in #688
• mono - chore: remove handlebars override by @jaredwray in #689
• mono - chore: remove zod override by @jaredwray in #690
• mono - chore: upgrade code quality dependencies by @jaredwray in #691
• mono - chore: upgrade TypeScript and build tooling by @jaredwray in #692
• mono - chore: upgrade monorepo tooling by @jaredwray in #693
• mono - chore: upgrade GitHub Actions by @jaredwray in #694
• mono - chore: upgrade Dev Container images by @jaredwray in #695
• mono - chore: upgrade docula by @jaredwray in #696
• @airhornjs/aws - chore: upgrade AWS SDK clients by @jaredwray in #697
• @airhornjs/twilio - chore: upgrade follow-redirects by @jaredwray in #698
• @airhornjs/pingram - chore: upgrade pingram by @jaredwray in #699
• airhorn - chore: upgrade hookified by @jaredwray in #700
• @airhornjs/twilio - chore: upgrade twilio by @jaredwray in #701

Full diff: https://github.com/jaredwray/airhorn/compare/v7.2.0...v7.2.1

Airhorn v7.2.0 — 2026-10-03

Add a retries option on send and refresh runtime and tooling dependencies.

Features

• add a retries option to send (`c22bd58`, #678)

  ```ts
  import { Airhorn } from "airhorn";

  const airhorn = new Airhorn();
  const template = { content: "Hello <%= name %>" };

  // Two extra attempts after a failed provider send. Default is 0.
  const result = await airhorn.sendSMS("+1234567890", template, { name: "Ada" }, {
  retries: 2,
  });

  // Or decide the limit from the provider that failed.
  await airhorn.sendSMS("+1234567890", template, { name: "Ada" }, {
  retries: (_message, provider) => (provider.name === "primary" ? 2 : 0),
  });
  ```

Internal

• upgrade writr 6.1.5→6.1.6 (`e9b1491`, #677)
• upgrade hookified 3.0.3→3.0.4 (`75ab716`, #676)
• upgrade pingram 1.0.25→1.0.34 (`46f1a5e`, #675)
• upgrade twilio 6.1.0→6.1.1 (`32f6405`, #674)
• upgrade @aws-sdk/client-ses and @aws-sdk/client-sns 3.1118.0→3.1141.0 (`fe80cad`, #673)
• upgrade docula 3.0.0→3.0.1 (`45ef91d`, #672)
• upgrade vitest and @vitest/coverage-v8 4.1.11→5.0.2 (`8625e32`, #671)
• upgrade Dev Container image javascript-node 5.1.1→5.2.1 (`3e51f21`, #670)
• upgrade GitHub Actions: zizmor-action 0.6.3→0.6.4, pnpm/action-setup 6.0.10→6.1.0, codecov-action 7.0.0→7.1.1, CodeQL 4.37.9→4.38.2, wrangler-action 4.0.0→4.1.3 (`4bd1891`, #669)
• upgrade pnpm 11.9.0→12.7.0 (`3cb6a4f`, #668)
• sync defense-in-depth files from agentic (`7bf7e5b`, #667)
• upgrade TypeScript build tooling: @types/node 26.3.0→24.19.0, tsdown 0.22.14→0.23.0, tsx 4.23.12→4.23.15 (`d77eabf`, #666)
• upgrade @biomejs/biome 2.5.10→2.5.14 (`dd55ac5`, #665)
• sync defense-in-depth files from agentic (`4dde445`, #664)

Contributors

• @jaredwray (15)

Full List of Changes

• mono - chore: sync defense-in-depth files from agentic by @jaredwray in #664
• mono - chore: upgrade code quality dependencies by @jaredwray in #665
• mono - chore: upgrade TypeScript and build tooling by @jaredwray in #666
• mono - chore: sync defense-in-depth files from agentic by @jaredwray in #667
• mono - chore: upgrade monorepo tooling by @jaredwray in #668
• mono - chore: upgrade GitHub Actions by @jaredwray in #669
• mono - chore: upgrade Dev Container images by @jaredwray in #670
• mono - chore: upgrade code quality dependencies by @jaredwray in #671
• mono - chore: upgrade docula by @jaredwray in #672
• aws - chore: upgrade AWS SDK dependencies by @jaredwray in #673
• twilio - chore: upgrade twilio by @jaredwray in #674
• pingram - chore: upgrade pingram by @jaredwray in #675
• airhorn - chore: upgrade hookified by @jaredwray in #676
• airhorn - chore: upgrade writr by @jaredwray in #677
• airhorn - feat: add a retries option to send by @jaredwray in #678

Full diff: https://github.com/jaredwray/airhorn/compare/V7.1.3...v7.2.0

v7.1.3 — 2026-09-02

Supply-chain hardening and dependency-maintenance patch across all packages. No API or behavior changes.

Bug Fixes

• override axios to 1.19.0 to remediate CVE-2025-62718, CVE-2026-42043, and CVE-2026-42044 (`4be207b`, #634)

Documentation

• add SECURITY.md and DEFENSE_IN_DEPTH.md (`9fc9c71`, #635)
• record repository lockdown (`62f1e25`, #650)
• record lockdown checklist complete (`8109d90`, #651)
• record completed npm publishing manuals (`7c24d2e`, #652)

Internal

• allow workerd build scripts to fix Cloudflare Pages deploy (`099e5b8`, #632)
• add CODEOWNERS for high-risk paths (`1527b31`, #636)
• bootstrap Aikido Safe Chain for cloud agents (`38ca49f`, #637)
• set 7-day pnpm dependency cooldown (`2a41d1a`, #638)
• set pnpm trustPolicy to no-downgrade (`0ae1dae`, #639)
• block pnpm lifecycle scripts by default (`2510b2b`, #640)
• block exotic pnpm subdependencies (`e15f699`, #641)
• set permissions: contents: read default (`77bc626`, #642)
• pin all GitHub Actions via actions-up (`a2bedf5`, #643)
• wrap CI installs with Socket Firewall (`76c0d70`, #644)
• lint GitHub Actions workflows with zizmor (`f83b4e2`, #645)
• disable persist-credentials on checkouts (`cd0122e`, #646)
• disable setup-node cache on publish jobs (`890a8a7`, #647)
• stage npm publishes from packed tarball (`489baac`, #648)
• gate npm stage publish on Aikido scan-release (`fcaae69`, #649)
• remove axios override (`0cb8529`, #653)
• upgrade code quality dependencies: @biomejs/biome 2.5.6→2.5.10, vitest & @vitest/coverage-v8 4.1.10→4.1.11 (`9a20cd9`, #654)
• upgrade TypeScript and build tooling: typescript 6.0.3→7.0.2, tsx 4.23.1→4.23.12, @types/node 24.12.2→26.3.0, docula 2.2.0→3.0.0 (`9f5b1fe`, #655)
• upgrade GitHub Actions: CodeQL 4.37.9, zizmor-action 0.6.3, Socket Firewall 1.15.1 (`079c38d`, #656)
• pin Dev Container images (`58ff1e4`, #657)
• upgrade @aws-sdk/client-ses & @aws-sdk/client-sns 3.1099.0→3.1118.0 (`690cf14`, #658)
• upgrade hookified 3.0.2→3.0.3 (`22b7861`, #659)
• upgrade pingram 1.0.16→1.0.25 (`8616447`, #660)
• upgrade twilio 6.0.2→6.1.0 (`89a0b0c`, #661)
• upgrade ecto 5.0.0→5.1.0 (`4f33419`, #662)

Contributors

• @jaredwray (29)

Full List of Changes

• Allow workerd build scripts to fix Cloudflare Pages deploy by @jaredwray in #632
• fix: override axios to 1.19.0 for CVE-2025-62718, CVE-2026-42043, and CVE-2026-42044 by @jaredwray in #634
• mono - chore: defense - add SECURITY.md and DEFENSE_IN_DEPTH.md by @jaredwray in #635
• mono - chore: defense - add CODEOWNERS for high-risk paths by @jaredwray in #636
• mono - chore: defense - bootstrap Aikido Safe Chain for cloud agents by @jaredwray in #637
• mono - chore: defense - set 7-day pnpm dependency cooldown by @jaredwray in #638
• mono - chore: defense - set pnpm trustPolicy to no-downgrade by @jaredwray in #639
• mono - chore: defense - block pnpm lifecycle scripts by default by @jaredwray in #640
• mono - chore: defense - block exotic pnpm subdependencies by @jaredwray in #641
• mono - chore: defense - set permissions: contents: read default by @jaredwray in #642
• mono - chore: defense - pin all GitHub Actions via actions-up by @jaredwray in #643
• mono - chore: defense - wrap CI installs with Socket Firewall by @jaredwray in #644
• mono - chore: defense - lint GitHub Actions workflows with zizmor by @jaredwray in #645
• mono - chore: defense - disable persist-credentials on checkouts by @jaredwray in #646
• mono - chore: defense - disable setup-node cache on publish jobs by @jaredwray in #647
• mono - chore: defense - stage npm publishes from packed tarball by @jaredwray in #648
• mono - chore: defense - gate npm stage publish on Aikido scan-release by @jaredwray in #649
• mono - chore: defense - record repository lockdown by @jaredwray in #650
• mono - chore: defense - record lockdown checklist complete by @jaredwray in #651
• mono - chore: defense - record completed npm publishing manuals by @jaredwray in #652
• mono - chore: remove axios override by @jaredwray in #653
• mono - chore: upgrade code quality dependencies by @jaredwray in #654
• mono - chore: upgrade TypeScript and build tooling by @jaredwray in #655
• mono - chore: upgrade GitHub Actions by @jaredwray in #656
• mono - chore: pin Dev Container images by @jaredwray in #657
• aws - chore: upgrade AWS SDK dependencies by @jaredwray in #658
• airhorn - chore: upgrade hookified by @jaredwray in #659
• pingram - chore: upgrade pingram by @jaredwray in #660
• twilio - chore: upgrade twilio by @jaredwray in #661
• airhorn - chore: upgrade ecto by @jaredwray in #662

Full diff: https://github.com/jaredwray/airhorn/compare/v7.1.2...v7.1.3