Fixed

• upload — vendor form-data so bundlers can ship it (#681)
• catalog — sync the sdk -stable alias to its base version
• catalog — sync the sdk -stable alias to the held base version
• soak — drop an unpublishable bare soak exclude

Internal

• fleet — resync -stable aliases, drop scripts with missing targets

Added

• http — drain a streamed error body under the response size cap
• ndjson — add one incremental line splitter for NDJSON reads

Fixed

• types — ship self-contained multipart declarations
• exports — declare the form-data chunk graph-only and revive the llms script
• sdk — drop the agent option the transport cannot forward
• sdk — stream scan and patch reads instead of buffering the whole body
• test — move the isolated-vitest cache out of node_modules
• build — bundle form-data as a lazily required chunk
• deps — keep the nock pin on the released 14.x line

Internal

• deps — absorb the fleet catalog heal (sdk 4.1.2)

Fixed

• deps — bump the @socketsecurity/lib catalog pin to 6.3.0
• test — normalize nock request-header capture across nock majors
• test — accept nock 14 legacy request headers in the content-type capture
• fuzz — sweep orphaned vitiate shm segments before the run

Fixed

• preserve fields the public batch consumer needs through the policy reshape (#670)

Added

• add browser/MV3 build (dist/index.browser.js) (#666)
• enrich default user agent with Node.js version and OS info (#665)
• add missing Socket API endpoints for SDK parity

Fixed

• types — type listOrganizations result as a keyed map, not an array (#667)
• fleet — disable typescript/no-unnecessary-type-assertion (#663)

Fixed

• install — the published manifest no longer declares a preinstall script pointing at a file the tarball does not ship; 4.0.3 installs failed when lifecycle scripts were enabled

Changed

• deps — update vendored @socketsecurity/lib to 6.2.3: engine-gate collapse and lazy-required purl specs trim the published bundle
• deps — update vendored @socketregistry/packageurl-js to 1.4.7

Changed

• batch — default batchPackageStream chunkSize to the API's 1024 max
• upload — lazy form-data — importing the SDK no longer binds node:http

Fixed

• install — use the canonical foundation bootstrap; segregate the firewall bootstrap entry
• resolve quality scan issues
• deps — import from @socketsecurity/lib errors/* leaves, not the dropped bare subpath
• codegen — converge the openapi sync pipeline