chore(main): release 1.6.0

Author: github-actions[bot]

CHANGELOG.md

@@ -1,5 +1,64 @@
 # Changelog
 
+## [1.6.0](https://github.com/cloudflare/vibesdk/compare/v1.5.0...v1.6.0) (2026-07-13)
+
+
+### Features
+
+* add bonk ai code reviews ([189dc48](https://github.com/cloudflare/vibesdk/commit/189dc4837166b3a6887a2d400eb76f0641cc36a0))
+* add bonk ai code reviews ([e16961b](https://github.com/cloudflare/vibesdk/commit/e16961b8ab367634471d75da0c5630c8abaf9046))
+* cloudflare oauth connect with usage limits and BYOK inference ([6fc180c](https://github.com/cloudflare/vibesdk/commit/6fc180cd1ee68f19f64aa99410468874d09132cd))
+* faster blueprint for minimal templates ([1321e43](https://github.com/cloudflare/vibesdk/commit/1321e43cdfecfef9bf47a09006c4408ffab1d8dd))
+* reduce limits ([9f810e7](https://github.com/cloudflare/vibesdk/commit/9f810e7dbc90039a0fa639bc676e1197066bef51))
+* reduce limits ([8299ba5](https://github.com/cloudflare/vibesdk/commit/8299ba554b6eee4920c0c7f5adaf0e677ebcaf3c))
+* reduce side of blueprint infer for minimal templates ([3eb0039](https://github.com/cloudflare/vibesdk/commit/3eb0039e57bd398afd7b3ea0616f0a532e292a61))
+* static analysis for browser rendered preview projects ([22be3f8](https://github.com/cloudflare/vibesdk/commit/22be3f8e74b1897254031dbffa0411893d7a5446))
+* static analysis for browser rendered preview projects ([320fc84](https://github.com/cloudflare/vibesdk/commit/320fc84454073e2a720deb6dca6deffa8e9060a3))
+* think-based agent + code space ([16670af](https://github.com/cloudflare/vibesdk/commit/16670affa66cae38520e47322399d06ee08d7fcc))
+
+
+### Bug Fixes
+
+* add missing lock changes ([b567804](https://github.com/cloudflare/vibesdk/commit/b5678042b61af353a1777695baaaf68f60134ac7))
+* **agents:** prevent RCE via bootstrap command whitelist bypass ([ae792a2](https://github.com/cloudflare/vibesdk/commit/ae792a2bb48282714c47464c15ca67942f2eab31))
+* **agents:** prevent RCE via bootstrap command whitelist bypass ([5dca3ab](https://github.com/cloudflare/vibesdk/commit/5dca3ab4bec4496c645e7663326705a9df1ec661))
+* ai gateway config issue ([01de759](https://github.com/cloudflare/vibesdk/commit/01de759cedaf09f5beb88a80fd8cdfb9dfb7fcfe))
+* allow editing package.json in scratch templates ([ee69533](https://github.com/cloudflare/vibesdk/commit/ee6953386fed3490ddcdc407c4bb26ce248d2506))
+* **apps:** harden public app endpoints against disclosure, DoS, view tampering ([1023f68](https://github.com/cloudflare/vibesdk/commit/1023f68ab816f04ea55e81f299b8300a9426b647))
+* **apps:** harden public app endpoints against disclosure, DoS, view tampering ([3600f72](https://github.com/cloudflare/vibesdk/commit/3600f7234202a1c15f53e0c657cce7fa155c1de3))
+* bonk model name ([57d83c0](https://github.com/cloudflare/vibesdk/commit/57d83c0ce4750adb38958901b27cf896afa99da5))
+* bug where preview url did not use tunnel url ([61291d0](https://github.com/cloudflare/vibesdk/commit/61291d0cb3843e398b19ab10ff682efbc1115210))
+* bug where preview url did not use tunnel url when getting instance state ([d2abffe](https://github.com/cloudflare/vibesdk/commit/d2abffed7c74e06fe7dead693f80a5c7e9684a8a))
+* **ci:** use canonical gemini-3-pro-preview slug ([9d22900](https://github.com/cloudflare/vibesdk/commit/9d22900628be6efa632bd322ed13529ef140cf45))
+* **ci:** use canonical gemini-3-pro-preview slug ([63e78b1](https://github.com/cloudflare/vibesdk/commit/63e78b1476787b088158d2cd02a9662d859d6785))
+* **ci:** use gemini in bonk ai-pr-review workflow and fix vuln ([17f56d6](https://github.com/cloudflare/vibesdk/commit/17f56d61f5addfc9b2aa95b608e35033e671e88d))
+* **ci:** use gemini in bonk ai-pr-review workflow and fix vuln ([277dbad](https://github.com/cloudflare/vibesdk/commit/277dbad88e3cc40570d41c260e7f1f9a2e5f61b0))
+* fixed github bot's commit mistakes ([a729366](https://github.com/cloudflare/vibesdk/commit/a72936654aa13113e4a73d8902bded052566f0cd))
+* improve browser rendering checking logic ([fa397bb](https://github.com/cloudflare/vibesdk/commit/fa397bb0b44aab332139ce99791bf5816dcec3c7))
+* manual template selection ([e440372](https://github.com/cloudflare/vibesdk/commit/e440372760d69e6f587bfcb94d93c7bece39a6b6))
+* more visibility for containers and workers ([a632039](https://github.com/cloudflare/vibesdk/commit/a632039d2b65a48a2448a5f99744b2f971c66174))
+* opencode version issue ([7842ab9](https://github.com/cloudflare/vibesdk/commit/7842ab91fb259753083f37e4571ed6c3b3f8d8fd))
+* pass manually selected template and skip ai flow ([ad7ae4e](https://github.com/cloudflare/vibesdk/commit/ad7ae4ec992ec85e17d073a15d63b28ba2462671))
+* prevent platform API key leak via user-supplied AI gateway baseUrl ([854676e](https://github.com/cloudflare/vibesdk/commit/854676ebf99642a7afa4055fd982815edc5508c8))
+* prevent platform API key leak via user-supplied AI gateway baseUrl ([d8a2526](https://github.com/cloudflare/vibesdk/commit/d8a2526e73f8e46e6c83271ce5e46730cb41f192))
+* **preview:** add CORS headers to space preview responses ([d4ab976](https://github.com/cloudflare/vibesdk/commit/d4ab976f97c3424fd5b3aa3175abfe7937e9e381))
+* **preview:** token+cookie auth for space previews and Safari banner ([402ab7c](https://github.com/cloudflare/vibesdk/commit/402ab7ca2b2365774027666250eadf95fead3139))
+* **preview:** token+cookie auth for space previews and Safari banner ([cf88d69](https://github.com/cloudflare/vibesdk/commit/cf88d691c5451b8e191c898154ae4758e13058d8))
+* race condition between instance start and static analysis ([befdde7](https://github.com/cloudflare/vibesdk/commit/befdde72fb8d6defd61184dbe47d8054232ce616))
+* remove opencode ref ([e358598](https://github.com/cloudflare/vibesdk/commit/e3585982d3eb5bdc4381dbcc586990435834bcc1))
+* resolve require("buffer") deploy error 10021 in Workers bundle ([f14b40c](https://github.com/cloudflare/vibesdk/commit/f14b40c26c9d1d183517d06519e325ff3c22c5a6))
+* **security:** block prompt-injection data exfiltration via chat ([f6c475f](https://github.com/cloudflare/vibesdk/commit/f6c475f26ab36fcb498f5864589b6fcf221db718))
+* **security:** block prompt-injection data exfiltration via chat ([b6ab895](https://github.com/cloudflare/vibesdk/commit/b6ab895e36e88885aec656cbb641c1f587d61bc2))
+* **security:** harden bootstrap command validation against postinstall RCE ([31bfc6f](https://github.com/cloudflare/vibesdk/commit/31bfc6fc5ca4721f8bd4079d2ef2146c4959d362))
+* **space:** strip Service-Worker-Allowed from preview responses ([918e974](https://github.com/cloudflare/vibesdk/commit/918e97480ee44e357abe99bf33c27259d6ac7ebd))
+* **space:** strip Service-Worker-Allowed from preview responses ([22f1900](https://github.com/cloudflare/vibesdk/commit/22f19000b5e06023001ba9741cc173f14e5f0530))
+* **udiff:** insert diff replacement content literally ([ea1c7be](https://github.com/cloudflare/vibesdk/commit/ea1c7be336521b3537c029650ad7710f18535e75))
+* **udiff:** insert diff replacement content literally (avoid $-substitution) ([6fdd77e](https://github.com/cloudflare/vibesdk/commit/6fdd77e9c6a92dd275946c46177ddc36cb70ffb5))
+* ui and logging imp for cf oauth ([fd8f281](https://github.com/cloudflare/vibesdk/commit/fd8f2814609b387cd8ad6156b52f1790619ffba9))
+* ui and logging imp for cf oauth ([86ebbdb](https://github.com/cloudflare/vibesdk/commit/86ebbdb358bed0ad7a6a90cf2cb1005523623f0d))
+* unintended change leading to bad behaviour ([7a586cc](https://github.com/cloudflare/vibesdk/commit/7a586cc41023546cace89df31a84fd00bddc427b))
+* wrangle rupdate ([9666d98](https://github.com/cloudflare/vibesdk/commit/9666d98518b2292b0aa58e1aee18ac1a95cbb2e9))
+
 ## [1.5.0](https://github.com/cloudflare/vibesdk/compare/v1.4.0...v1.5.0) (2026-02-03)
 
 

package.json

@@ -1,7 +1,7 @@
 {
 	"name": "vibesdk",
 	"private": true,
-	"version": "1.5.0",
+	"version": "1.6.0",
 	"type": "module",
 	"workspaces": [
 		"space"