Loading workspace insights... Statistics interval
7 days30 daysLatest CI Pipeline Executions
d85e8816 📦 Publish SDKs (#4725)
This PR was opened by the [Changesets
release](https://github.com/changesets/action) GitHub action. When
you're ready to do a release, you can merge this and the packages will
be published to npm automatically. If you're not ready to do a release
yet, that's fine, whenever you add more changesets to main, this PR will
be updated.
# Releases
## @builder.io/sdk@6.3.1
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/react@9.4.1
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
- Updated dependencies [95c6a94]
- @builder.io/sdk@6.3.1
## @builder.io/sdk-angular@0.25.6
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/sdk-react-nextjs@0.25.6
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/sdk-qwik@0.25.6
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/sdk-react@5.2.5
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/sdk-react-native@5.2.5
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/sdk-solid@5.2.5
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/sdk-svelte@5.2.5
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/sdk-vue@5.2.5
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> **Medium Risk**
> Tightens postMessage origin handling in visual editing, which is
security-sensitive; unlikely to break legitimate Builder hosts but could
affect custom `trustedHosts` or unusual preview URLs.
>
> **Overview**
> This is an automated **Changesets release** that publishes patch
versions across Gen1 and Gen2 Builder SDKs. It removes the pending
changeset file and bumps `package.json` versions plus `CHANGELOG.md`
entries for each affected package.
>
> The release ships commit **95c6a94**: **stricter validation of
`postMessage` origins** between hosted sites and the visual editor. SDKs
now require origins to parse as **HTTP/HTTPS**, match **exact trusted
hostnames** (not loose substring checks), and reject malformed or
dangerous schemes (e.g. `javascript:`). Gen1 `@builder.io/sdk` **6.3.1**
and `@builder.io/react` **9.4.1** are included; Gen2 packages (Angular,
Next.js, Qwik, React, React Native, Solid, Svelte, Vue) receive aligned
patch bumps with the same changelog note.
>
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
bbb25adc5137303d207c76805778942a42cfefdb. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> bfaef841 📦 Publish SDKs (#4725)
This PR was opened by the [Changesets
release](https://github.com/changesets/action) GitHub action. When
you're ready to do a release, you can merge this and the packages will
be published to npm automatically. If you're not ready to do a release
yet, that's fine, whenever you add more changesets to main, this PR will
be updated.
# Releases
## @builder.io/sdk@6.3.1
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/react@9.4.1
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
- Updated dependencies [95c6a94]
- @builder.io/sdk@6.3.1
## @builder.io/sdk-angular@0.25.6
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/sdk-react-nextjs@0.25.6
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/sdk-qwik@0.25.6
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/sdk-react@5.2.5
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/sdk-react-native@5.2.5
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/sdk-solid@5.2.5
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/sdk-svelte@5.2.5
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/sdk-vue@5.2.5
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> **Medium Risk**
> Tightens postMessage origin handling in visual editing, which is
security-sensitive; unlikely to break legitimate Builder hosts but could
affect custom `trustedHosts` or unusual preview URLs.
>
> **Overview**
> This is an automated **Changesets release** that publishes patch
versions across Gen1 and Gen2 Builder SDKs. It removes the pending
changeset file and bumps `package.json` versions plus `CHANGELOG.md`
entries for each affected package.
>
> The release ships commit **95c6a94**: **stricter validation of
`postMessage` origins** between hosted sites and the visual editor. SDKs
now require origins to parse as **HTTP/HTTPS**, match **exact trusted
hostnames** (not loose substring checks), and reject malformed or
dangerous schemes (e.g. `javascript:`). Gen1 `@builder.io/sdk` **6.3.1**
and `@builder.io/react` **9.4.1** are included; Gen2 packages (Angular,
Next.js, Qwik, React, React Native, Solid, Svelte, Vue) receive aligned
patch bumps with the same changelog note.
>
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
bbb25adc5137303d207c76805778942a42cfefdb. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> d85e8816 📦 Publish SDKs (#4725)
This PR was opened by the [Changesets
release](https://github.com/changesets/action) GitHub action. When
you're ready to do a release, you can merge this and the packages will
be published to npm automatically. If you're not ready to do a release
yet, that's fine, whenever you add more changesets to main, this PR will
be updated.
# Releases
## @builder.io/sdk@6.3.1
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/react@9.4.1
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
- Updated dependencies [95c6a94]
- @builder.io/sdk@6.3.1
## @builder.io/sdk-angular@0.25.6
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/sdk-react-nextjs@0.25.6
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/sdk-qwik@0.25.6
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/sdk-react@5.2.5
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/sdk-react-native@5.2.5
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/sdk-solid@5.2.5
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/sdk-svelte@5.2.5
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/sdk-vue@5.2.5
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> **Medium Risk**
> Tightens postMessage origin handling in visual editing, which is
security-sensitive; unlikely to break legitimate Builder hosts but could
affect custom `trustedHosts` or unusual preview URLs.
>
> **Overview**
> This is an automated **Changesets release** that publishes patch
versions across Gen1 and Gen2 Builder SDKs. It removes the pending
changeset file and bumps `package.json` versions plus `CHANGELOG.md`
entries for each affected package.
>
> The release ships commit **95c6a94**: **stricter validation of
`postMessage` origins** between hosted sites and the visual editor. SDKs
now require origins to parse as **HTTP/HTTPS**, match **exact trusted
hostnames** (not loose substring checks), and reject malformed or
dangerous schemes (e.g. `javascript:`). Gen1 `@builder.io/sdk` **6.3.1**
and `@builder.io/react` **9.4.1** are included; Gen2 packages (Angular,
Next.js, Qwik, React, React Native, Solid, Svelte, Vue) receive aligned
patch bumps with the same changelog note.
>
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
bbb25adc5137303d207c76805778942a42cfefdb. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> d85e8816 📦 Publish SDKs (#4725)
This PR was opened by the [Changesets
release](https://github.com/changesets/action) GitHub action. When
you're ready to do a release, you can merge this and the packages will
be published to npm automatically. If you're not ready to do a release
yet, that's fine, whenever you add more changesets to main, this PR will
be updated.
# Releases
## @builder.io/sdk@6.3.1
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/react@9.4.1
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
- Updated dependencies [95c6a94]
- @builder.io/sdk@6.3.1
## @builder.io/sdk-angular@0.25.6
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/sdk-react-nextjs@0.25.6
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/sdk-qwik@0.25.6
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/sdk-react@5.2.5
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/sdk-react-native@5.2.5
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/sdk-solid@5.2.5
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/sdk-svelte@5.2.5
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/sdk-vue@5.2.5
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> **Medium Risk**
> Tightens postMessage origin handling in visual editing, which is
security-sensitive; unlikely to break legitimate Builder hosts but could
affect custom `trustedHosts` or unusual preview URLs.
>
> **Overview**
> This is an automated **Changesets release** that publishes patch
versions across Gen1 and Gen2 Builder SDKs. It removes the pending
changeset file and bumps `package.json` versions plus `CHANGELOG.md`
entries for each affected package.
>
> The release ships commit **95c6a94**: **stricter validation of
`postMessage` origins** between hosted sites and the visual editor. SDKs
now require origins to parse as **HTTP/HTTPS**, match **exact trusted
hostnames** (not loose substring checks), and reject malformed or
dangerous schemes (e.g. `javascript:`). Gen1 `@builder.io/sdk` **6.3.1**
and `@builder.io/react` **9.4.1** are included; Gen2 packages (Angular,
Next.js, Qwik, React, React Native, Solid, Svelte, Vue) receive aligned
patch bumps with the same changelog note.
>
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
bbb25adc5137303d207c76805778942a42cfefdb. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> d85e8816 📦 Publish SDKs (#4725)
This PR was opened by the [Changesets
release](https://github.com/changesets/action) GitHub action. When
you're ready to do a release, you can merge this and the packages will
be published to npm automatically. If you're not ready to do a release
yet, that's fine, whenever you add more changesets to main, this PR will
be updated.
# Releases
## @builder.io/sdk@6.3.1
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/react@9.4.1
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
- Updated dependencies [95c6a94]
- @builder.io/sdk@6.3.1
## @builder.io/sdk-angular@0.25.6
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/sdk-react-nextjs@0.25.6
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/sdk-qwik@0.25.6
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/sdk-react@5.2.5
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/sdk-react-native@5.2.5
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/sdk-solid@5.2.5
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/sdk-svelte@5.2.5
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
## @builder.io/sdk-vue@5.2.5
### Patch Changes
- 95c6a94: Validate visual editor message origins with exact trusted
hostnames and reject malformed or non-HTTP origins.
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> **Medium Risk**
> Tightens postMessage origin handling in visual editing, which is
security-sensitive; unlikely to break legitimate Builder hosts but could
affect custom `trustedHosts` or unusual preview URLs.
>
> **Overview**
> This is an automated **Changesets release** that publishes patch
versions across Gen1 and Gen2 Builder SDKs. It removes the pending
changeset file and bumps `package.json` versions plus `CHANGELOG.md`
entries for each affected package.
>
> The release ships commit **95c6a94**: **stricter validation of
`postMessage` origins** between hosted sites and the visual editor. SDKs
now require origins to parse as **HTTP/HTTPS**, match **exact trusted
hostnames** (not loose substring checks), and reject malformed or
dangerous schemes (e.g. `javascript:`). Gen1 `@builder.io/sdk` **6.3.1**
and `@builder.io/react` **9.4.1** are included; Gen2 packages (Angular,
Next.js, Qwik, React, React Native, Solid, Svelte, Vue) receive aligned
patch bumps with the same changelog note.
>
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
bbb25adc5137303d207c76805778942a42cfefdb. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> 27e443e1 📦 Publish SDKs (#4691)
This PR was opened by the [Changesets
release](https://github.com/changesets/action) GitHub action. When
you're ready to do a release, you can merge this and the packages will
be published to npm automatically. If you're not ready to do a release
yet, that's fine, whenever you add more changesets to main, this PR will
be updated.
# Releases
## @builder.io/sdk-angular@0.25.5
### Patch Changes
- 071f939: Stop injecting duplicate inline A/B test scripts on pages
with multiple Content components. The `window.builderIoAbTest` /
`window.builderIoRenderContent` init script is now only emitted when a
Content actually renders A/B variants, and the definition is idempotent
and self-removing on hydration targets. This avoids the duplication
without the client-side DOM mutation that caused the previous hydration
regression.
## @builder.io/sdk-react-nextjs@0.25.5
### Patch Changes
- 071f939: Stop injecting duplicate inline A/B test scripts on pages
with multiple Content components. The `window.builderIoAbTest` /
`window.builderIoRenderContent` init script is now only emitted when a
Content actually renders A/B variants, and the definition is idempotent
and self-removing on hydration targets. This avoids the duplication
without the client-side DOM mutation that caused the previous hydration
regression.
- 10b6707: Bump `next` peer dependency to `>=13.5.9` to address
authorization bypass in Next.js middleware (CVE-2025-29927)
## @builder.io/sdk-qwik@0.25.5
### Patch Changes
- 071f939: Stop injecting duplicate inline A/B test scripts on pages
with multiple Content components. The `window.builderIoAbTest` /
`window.builderIoRenderContent` init script is now only emitted when a
Content actually renders A/B variants, and the definition is idempotent
and self-removing on hydration targets. This avoids the duplication
without the client-side DOM mutation that caused the previous hydration
regression.
## @builder.io/sdk-react@5.2.4
### Patch Changes
- 071f939: Stop injecting duplicate inline A/B test scripts on pages
with multiple Content components. The `window.builderIoAbTest` /
`window.builderIoRenderContent` init script is now only emitted when a
Content actually renders A/B variants, and the definition is idempotent
and self-removing on hydration targets. This avoids the duplication
without the client-side DOM mutation that caused the previous hydration
regression.
## @builder.io/sdk-react-native@5.2.4
### Patch Changes
- 071f939: Stop injecting duplicate inline A/B test scripts on pages
with multiple Content components. The `window.builderIoAbTest` /
`window.builderIoRenderContent` init script is now only emitted when a
Content actually renders A/B variants, and the definition is idempotent
and self-removing on hydration targets. This avoids the duplication
without the client-side DOM mutation that caused the previous hydration
regression.
## @builder.io/sdk-solid@5.2.4
### Patch Changes
- 071f939: Stop injecting duplicate inline A/B test scripts on pages
with multiple Content components. The `window.builderIoAbTest` /
`window.builderIoRenderContent` init script is now only emitted when a
Content actually renders A/B variants, and the definition is idempotent
and self-removing on hydration targets. This avoids the duplication
without the client-side DOM mutation that caused the previous hydration
regression.
## @builder.io/sdk-svelte@5.2.4
### Patch Changes
- 071f939: Stop injecting duplicate inline A/B test scripts on pages
with multiple Content components. The `window.builderIoAbTest` /
`window.builderIoRenderContent` init script is now only emitted when a
Content actually renders A/B variants, and the definition is idempotent
and self-removing on hydration targets. This avoids the duplication
without the client-side DOM mutation that caused the previous hydration
regression.
## @builder.io/sdk-vue@5.2.4
### Patch Changes
- 071f939: Stop injecting duplicate inline A/B test scripts on pages
with multiple Content components. The `window.builderIoAbTest` /
`window.builderIoRenderContent` init script is now only emitted when a
Content actually renders A/B variants, and the definition is idempotent
and self-removing on hydration targets. This avoids the duplication
without the client-side DOM mutation that caused the previous hydration
regression.
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> **Medium Risk**
> A/B and SSR/hydration script behavior affects all framework SDK
consumers; the Next peer bump may block installs on vulnerable Next
versions until upgraded.
>
> **Overview**
> This **Changesets release PR** bumps published Gen2 SDK versions and
records patch notes; merging triggers npm publish.
>
> **A/B test inline script (all listed SDKs):** Re-applies the dedupe
fix after a prior revert—`window.builderIoAbTest` /
`window.builderIoRenderContent` init scripts are emitted only when
`Content` actually renders A/B variants, with idempotent definitions
that self-remove on hydration targets, avoiding duplicate scripts on
multi-`Content` pages without client-side DOM mutation that caused
hydration regressions.
>
> **Next.js SDK only (`@builder.io/sdk-react-nextjs@0.25.5`):** Raises
the `next` peer dependency to `>=13.5.9` for CVE-2025-29927 (middleware
authorization bypass).
>
> Version bumps: Angular `0.25.5`; Next/Qwik `0.25.5`; React, React
Native, Solid, Svelte, Vue `5.2.4`. Pending changeset files under
`.changeset/` are removed as part of the release workflow.
>
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
a8b9547d52d1bfb9aca388bde43a726f46db540d. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> 26eae805 📦 Publish SDKs (#4691)
This PR was opened by the [Changesets
release](https://github.com/changesets/action) GitHub action. When
you're ready to do a release, you can merge this and the packages will
be published to npm automatically. If you're not ready to do a release
yet, that's fine, whenever you add more changesets to main, this PR will
be updated.
# Releases
## @builder.io/sdk-angular@0.25.5
### Patch Changes
- 071f939: Stop injecting duplicate inline A/B test scripts on pages
with multiple Content components. The `window.builderIoAbTest` /
`window.builderIoRenderContent` init script is now only emitted when a
Content actually renders A/B variants, and the definition is idempotent
and self-removing on hydration targets. This avoids the duplication
without the client-side DOM mutation that caused the previous hydration
regression.
## @builder.io/sdk-react-nextjs@0.25.5
### Patch Changes
- 071f939: Stop injecting duplicate inline A/B test scripts on pages
with multiple Content components. The `window.builderIoAbTest` /
`window.builderIoRenderContent` init script is now only emitted when a
Content actually renders A/B variants, and the definition is idempotent
and self-removing on hydration targets. This avoids the duplication
without the client-side DOM mutation that caused the previous hydration
regression.
- 10b6707: Bump `next` peer dependency to `>=13.5.9` to address
authorization bypass in Next.js middleware (CVE-2025-29927)
## @builder.io/sdk-qwik@0.25.5
### Patch Changes
- 071f939: Stop injecting duplicate inline A/B test scripts on pages
with multiple Content components. The `window.builderIoAbTest` /
`window.builderIoRenderContent` init script is now only emitted when a
Content actually renders A/B variants, and the definition is idempotent
and self-removing on hydration targets. This avoids the duplication
without the client-side DOM mutation that caused the previous hydration
regression.
## @builder.io/sdk-react@5.2.4
### Patch Changes
- 071f939: Stop injecting duplicate inline A/B test scripts on pages
with multiple Content components. The `window.builderIoAbTest` /
`window.builderIoRenderContent` init script is now only emitted when a
Content actually renders A/B variants, and the definition is idempotent
and self-removing on hydration targets. This avoids the duplication
without the client-side DOM mutation that caused the previous hydration
regression.
## @builder.io/sdk-react-native@5.2.4
### Patch Changes
- 071f939: Stop injecting duplicate inline A/B test scripts on pages
with multiple Content components. The `window.builderIoAbTest` /
`window.builderIoRenderContent` init script is now only emitted when a
Content actually renders A/B variants, and the definition is idempotent
and self-removing on hydration targets. This avoids the duplication
without the client-side DOM mutation that caused the previous hydration
regression.
## @builder.io/sdk-solid@5.2.4
### Patch Changes
- 071f939: Stop injecting duplicate inline A/B test scripts on pages
with multiple Content components. The `window.builderIoAbTest` /
`window.builderIoRenderContent` init script is now only emitted when a
Content actually renders A/B variants, and the definition is idempotent
and self-removing on hydration targets. This avoids the duplication
without the client-side DOM mutation that caused the previous hydration
regression.
## @builder.io/sdk-svelte@5.2.4
### Patch Changes
- 071f939: Stop injecting duplicate inline A/B test scripts on pages
with multiple Content components. The `window.builderIoAbTest` /
`window.builderIoRenderContent` init script is now only emitted when a
Content actually renders A/B variants, and the definition is idempotent
and self-removing on hydration targets. This avoids the duplication
without the client-side DOM mutation that caused the previous hydration
regression.
## @builder.io/sdk-vue@5.2.4
### Patch Changes
- 071f939: Stop injecting duplicate inline A/B test scripts on pages
with multiple Content components. The `window.builderIoAbTest` /
`window.builderIoRenderContent` init script is now only emitted when a
Content actually renders A/B variants, and the definition is idempotent
and self-removing on hydration targets. This avoids the duplication
without the client-side DOM mutation that caused the previous hydration
regression.
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> **Medium Risk**
> A/B and SSR/hydration script behavior affects all framework SDK
consumers; the Next peer bump may block installs on vulnerable Next
versions until upgraded.
>
> **Overview**
> This **Changesets release PR** bumps published Gen2 SDK versions and
records patch notes; merging triggers npm publish.
>
> **A/B test inline script (all listed SDKs):** Re-applies the dedupe
fix after a prior revert—`window.builderIoAbTest` /
`window.builderIoRenderContent` init scripts are emitted only when
`Content` actually renders A/B variants, with idempotent definitions
that self-remove on hydration targets, avoiding duplicate scripts on
multi-`Content` pages without client-side DOM mutation that caused
hydration regressions.
>
> **Next.js SDK only (`@builder.io/sdk-react-nextjs@0.25.5`):** Raises
the `next` peer dependency to `>=13.5.9` for CVE-2025-29927 (middleware
authorization bypass).
>
> Version bumps: Angular `0.25.5`; Next/Qwik `0.25.5`; React, React
Native, Solid, Svelte, Vue `5.2.4`. Pending changeset files under
`.changeset/` are removed as part of the release workflow.
>
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
a8b9547d52d1bfb9aca388bde43a726f46db540d. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> 27e443e1 📦 Publish SDKs (#4691)
This PR was opened by the [Changesets
release](https://github.com/changesets/action) GitHub action. When
you're ready to do a release, you can merge this and the packages will
be published to npm automatically. If you're not ready to do a release
yet, that's fine, whenever you add more changesets to main, this PR will
be updated.
# Releases
## @builder.io/sdk-angular@0.25.5
### Patch Changes
- 071f939: Stop injecting duplicate inline A/B test scripts on pages
with multiple Content components. The `window.builderIoAbTest` /
`window.builderIoRenderContent` init script is now only emitted when a
Content actually renders A/B variants, and the definition is idempotent
and self-removing on hydration targets. This avoids the duplication
without the client-side DOM mutation that caused the previous hydration
regression.
## @builder.io/sdk-react-nextjs@0.25.5
### Patch Changes
- 071f939: Stop injecting duplicate inline A/B test scripts on pages
with multiple Content components. The `window.builderIoAbTest` /
`window.builderIoRenderContent` init script is now only emitted when a
Content actually renders A/B variants, and the definition is idempotent
and self-removing on hydration targets. This avoids the duplication
without the client-side DOM mutation that caused the previous hydration
regression.
- 10b6707: Bump `next` peer dependency to `>=13.5.9` to address
authorization bypass in Next.js middleware (CVE-2025-29927)
## @builder.io/sdk-qwik@0.25.5
### Patch Changes
- 071f939: Stop injecting duplicate inline A/B test scripts on pages
with multiple Content components. The `window.builderIoAbTest` /
`window.builderIoRenderContent` init script is now only emitted when a
Content actually renders A/B variants, and the definition is idempotent
and self-removing on hydration targets. This avoids the duplication
without the client-side DOM mutation that caused the previous hydration
regression.
## @builder.io/sdk-react@5.2.4
### Patch Changes
- 071f939: Stop injecting duplicate inline A/B test scripts on pages
with multiple Content components. The `window.builderIoAbTest` /
`window.builderIoRenderContent` init script is now only emitted when a
Content actually renders A/B variants, and the definition is idempotent
and self-removing on hydration targets. This avoids the duplication
without the client-side DOM mutation that caused the previous hydration
regression.
## @builder.io/sdk-react-native@5.2.4
### Patch Changes
- 071f939: Stop injecting duplicate inline A/B test scripts on pages
with multiple Content components. The `window.builderIoAbTest` /
`window.builderIoRenderContent` init script is now only emitted when a
Content actually renders A/B variants, and the definition is idempotent
and self-removing on hydration targets. This avoids the duplication
without the client-side DOM mutation that caused the previous hydration
regression.
## @builder.io/sdk-solid@5.2.4
### Patch Changes
- 071f939: Stop injecting duplicate inline A/B test scripts on pages
with multiple Content components. The `window.builderIoAbTest` /
`window.builderIoRenderContent` init script is now only emitted when a
Content actually renders A/B variants, and the definition is idempotent
and self-removing on hydration targets. This avoids the duplication
without the client-side DOM mutation that caused the previous hydration
regression.
## @builder.io/sdk-svelte@5.2.4
### Patch Changes
- 071f939: Stop injecting duplicate inline A/B test scripts on pages
with multiple Content components. The `window.builderIoAbTest` /
`window.builderIoRenderContent` init script is now only emitted when a
Content actually renders A/B variants, and the definition is idempotent
and self-removing on hydration targets. This avoids the duplication
without the client-side DOM mutation that caused the previous hydration
regression.
## @builder.io/sdk-vue@5.2.4
### Patch Changes
- 071f939: Stop injecting duplicate inline A/B test scripts on pages
with multiple Content components. The `window.builderIoAbTest` /
`window.builderIoRenderContent` init script is now only emitted when a
Content actually renders A/B variants, and the definition is idempotent
and self-removing on hydration targets. This avoids the duplication
without the client-side DOM mutation that caused the previous hydration
regression.
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> **Medium Risk**
> A/B and SSR/hydration script behavior affects all framework SDK
consumers; the Next peer bump may block installs on vulnerable Next
versions until upgraded.
>
> **Overview**
> This **Changesets release PR** bumps published Gen2 SDK versions and
records patch notes; merging triggers npm publish.
>
> **A/B test inline script (all listed SDKs):** Re-applies the dedupe
fix after a prior revert—`window.builderIoAbTest` /
`window.builderIoRenderContent` init scripts are emitted only when
`Content` actually renders A/B variants, with idempotent definitions
that self-remove on hydration targets, avoiding duplicate scripts on
multi-`Content` pages without client-side DOM mutation that caused
hydration regressions.
>
> **Next.js SDK only (`@builder.io/sdk-react-nextjs@0.25.5`):** Raises
the `next` peer dependency to `>=13.5.9` for CVE-2025-29927 (middleware
authorization bypass).
>
> Version bumps: Angular `0.25.5`; Next/Qwik `0.25.5`; React, React
Native, Solid, Svelte, Vue `5.2.4`. Pending changeset files under
`.changeset/` are removed as part of the release workflow.
>
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
a8b9547d52d1bfb9aca388bde43a726f46db540d. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> 5d4130a6 📦 Publish SDKs (#4691)
This PR was opened by the [Changesets
release](https://github.com/changesets/action) GitHub action. When
you're ready to do a release, you can merge this and the packages will
be published to npm automatically. If you're not ready to do a release
yet, that's fine, whenever you add more changesets to main, this PR will
be updated.
# Releases
## @builder.io/sdk-angular@0.25.5
### Patch Changes
- 071f939: Stop injecting duplicate inline A/B test scripts on pages
with multiple Content components. The `window.builderIoAbTest` /
`window.builderIoRenderContent` init script is now only emitted when a
Content actually renders A/B variants, and the definition is idempotent
and self-removing on hydration targets. This avoids the duplication
without the client-side DOM mutation that caused the previous hydration
regression.
## @builder.io/sdk-react-nextjs@0.25.5
### Patch Changes
- 071f939: Stop injecting duplicate inline A/B test scripts on pages
with multiple Content components. The `window.builderIoAbTest` /
`window.builderIoRenderContent` init script is now only emitted when a
Content actually renders A/B variants, and the definition is idempotent
and self-removing on hydration targets. This avoids the duplication
without the client-side DOM mutation that caused the previous hydration
regression.
- 10b6707: Bump `next` peer dependency to `>=13.5.9` to address
authorization bypass in Next.js middleware (CVE-2025-29927)
## @builder.io/sdk-qwik@0.25.5
### Patch Changes
- 071f939: Stop injecting duplicate inline A/B test scripts on pages
with multiple Content components. The `window.builderIoAbTest` /
`window.builderIoRenderContent` init script is now only emitted when a
Content actually renders A/B variants, and the definition is idempotent
and self-removing on hydration targets. This avoids the duplication
without the client-side DOM mutation that caused the previous hydration
regression.
## @builder.io/sdk-react@5.2.4
### Patch Changes
- 071f939: Stop injecting duplicate inline A/B test scripts on pages
with multiple Content components. The `window.builderIoAbTest` /
`window.builderIoRenderContent` init script is now only emitted when a
Content actually renders A/B variants, and the definition is idempotent
and self-removing on hydration targets. This avoids the duplication
without the client-side DOM mutation that caused the previous hydration
regression.
## @builder.io/sdk-react-native@5.2.4
### Patch Changes
- 071f939: Stop injecting duplicate inline A/B test scripts on pages
with multiple Content components. The `window.builderIoAbTest` /
`window.builderIoRenderContent` init script is now only emitted when a
Content actually renders A/B variants, and the definition is idempotent
and self-removing on hydration targets. This avoids the duplication
without the client-side DOM mutation that caused the previous hydration
regression.
## @builder.io/sdk-solid@5.2.4
### Patch Changes
- 071f939: Stop injecting duplicate inline A/B test scripts on pages
with multiple Content components. The `window.builderIoAbTest` /
`window.builderIoRenderContent` init script is now only emitted when a
Content actually renders A/B variants, and the definition is idempotent
and self-removing on hydration targets. This avoids the duplication
without the client-side DOM mutation that caused the previous hydration
regression.
## @builder.io/sdk-svelte@5.2.4
### Patch Changes
- 071f939: Stop injecting duplicate inline A/B test scripts on pages
with multiple Content components. The `window.builderIoAbTest` /
`window.builderIoRenderContent` init script is now only emitted when a
Content actually renders A/B variants, and the definition is idempotent
and self-removing on hydration targets. This avoids the duplication
without the client-side DOM mutation that caused the previous hydration
regression.
## @builder.io/sdk-vue@5.2.4
### Patch Changes
- 071f939: Stop injecting duplicate inline A/B test scripts on pages
with multiple Content components. The `window.builderIoAbTest` /
`window.builderIoRenderContent` init script is now only emitted when a
Content actually renders A/B variants, and the definition is idempotent
and self-removing on hydration targets. This avoids the duplication
without the client-side DOM mutation that caused the previous hydration
regression.
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> **Medium Risk**
> A/B and SSR/hydration script behavior affects all framework SDK
consumers; the Next peer bump may block installs on vulnerable Next
versions until upgraded.
>
> **Overview**
> This **Changesets release PR** bumps published Gen2 SDK versions and
records patch notes; merging triggers npm publish.
>
> **A/B test inline script (all listed SDKs):** Re-applies the dedupe
fix after a prior revert—`window.builderIoAbTest` /
`window.builderIoRenderContent` init scripts are emitted only when
`Content` actually renders A/B variants, with idempotent definitions
that self-remove on hydration targets, avoiding duplicate scripts on
multi-`Content` pages without client-side DOM mutation that caused
hydration regressions.
>
> **Next.js SDK only (`@builder.io/sdk-react-nextjs@0.25.5`):** Raises
the `next` peer dependency to `>=13.5.9` for CVE-2025-29927 (middleware
authorization bypass).
>
> Version bumps: Angular `0.25.5`; Next/Qwik `0.25.5`; React, React
Native, Solid, Svelte, Vue `5.2.4`. Pending changeset files under
`.changeset/` are removed as part of the release workflow.
>
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
a8b9547d52d1bfb9aca388bde43a726f46db540d. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> 27e443e1 📦 Publish SDKs (#4691)
This PR was opened by the [Changesets
release](https://github.com/changesets/action) GitHub action. When
you're ready to do a release, you can merge this and the packages will
be published to npm automatically. If you're not ready to do a release
yet, that's fine, whenever you add more changesets to main, this PR will
be updated.
# Releases
## @builder.io/sdk-angular@0.25.5
### Patch Changes
- 071f939: Stop injecting duplicate inline A/B test scripts on pages
with multiple Content components. The `window.builderIoAbTest` /
`window.builderIoRenderContent` init script is now only emitted when a
Content actually renders A/B variants, and the definition is idempotent
and self-removing on hydration targets. This avoids the duplication
without the client-side DOM mutation that caused the previous hydration
regression.
## @builder.io/sdk-react-nextjs@0.25.5
### Patch Changes
- 071f939: Stop injecting duplicate inline A/B test scripts on pages
with multiple Content components. The `window.builderIoAbTest` /
`window.builderIoRenderContent` init script is now only emitted when a
Content actually renders A/B variants, and the definition is idempotent
and self-removing on hydration targets. This avoids the duplication
without the client-side DOM mutation that caused the previous hydration
regression.
- 10b6707: Bump `next` peer dependency to `>=13.5.9` to address
authorization bypass in Next.js middleware (CVE-2025-29927)
## @builder.io/sdk-qwik@0.25.5
### Patch Changes
- 071f939: Stop injecting duplicate inline A/B test scripts on pages
with multiple Content components. The `window.builderIoAbTest` /
`window.builderIoRenderContent` init script is now only emitted when a
Content actually renders A/B variants, and the definition is idempotent
and self-removing on hydration targets. This avoids the duplication
without the client-side DOM mutation that caused the previous hydration
regression.
## @builder.io/sdk-react@5.2.4
### Patch Changes
- 071f939: Stop injecting duplicate inline A/B test scripts on pages
with multiple Content components. The `window.builderIoAbTest` /
`window.builderIoRenderContent` init script is now only emitted when a
Content actually renders A/B variants, and the definition is idempotent
and self-removing on hydration targets. This avoids the duplication
without the client-side DOM mutation that caused the previous hydration
regression.
## @builder.io/sdk-react-native@5.2.4
### Patch Changes
- 071f939: Stop injecting duplicate inline A/B test scripts on pages
with multiple Content components. The `window.builderIoAbTest` /
`window.builderIoRenderContent` init script is now only emitted when a
Content actually renders A/B variants, and the definition is idempotent
and self-removing on hydration targets. This avoids the duplication
without the client-side DOM mutation that caused the previous hydration
regression.
## @builder.io/sdk-solid@5.2.4
### Patch Changes
- 071f939: Stop injecting duplicate inline A/B test scripts on pages
with multiple Content components. The `window.builderIoAbTest` /
`window.builderIoRenderContent` init script is now only emitted when a
Content actually renders A/B variants, and the definition is idempotent
and self-removing on hydration targets. This avoids the duplication
without the client-side DOM mutation that caused the previous hydration
regression.
## @builder.io/sdk-svelte@5.2.4
### Patch Changes
- 071f939: Stop injecting duplicate inline A/B test scripts on pages
with multiple Content components. The `window.builderIoAbTest` /
`window.builderIoRenderContent` init script is now only emitted when a
Content actually renders A/B variants, and the definition is idempotent
and self-removing on hydration targets. This avoids the duplication
without the client-side DOM mutation that caused the previous hydration
regression.
## @builder.io/sdk-vue@5.2.4
### Patch Changes
- 071f939: Stop injecting duplicate inline A/B test scripts on pages
with multiple Content components. The `window.builderIoAbTest` /
`window.builderIoRenderContent` init script is now only emitted when a
Content actually renders A/B variants, and the definition is idempotent
and self-removing on hydration targets. This avoids the duplication
without the client-side DOM mutation that caused the previous hydration
regression.
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> **Medium Risk**
> A/B and SSR/hydration script behavior affects all framework SDK
consumers; the Next peer bump may block installs on vulnerable Next
versions until upgraded.
>
> **Overview**
> This **Changesets release PR** bumps published Gen2 SDK versions and
records patch notes; merging triggers npm publish.
>
> **A/B test inline script (all listed SDKs):** Re-applies the dedupe
fix after a prior revert—`window.builderIoAbTest` /
`window.builderIoRenderContent` init scripts are emitted only when
`Content` actually renders A/B variants, with idempotent definitions
that self-remove on hydration targets, avoiding duplicate scripts on
multi-`Content` pages without client-side DOM mutation that caused
hydration regressions.
>
> **Next.js SDK only (`@builder.io/sdk-react-nextjs@0.25.5`):** Raises
the `next` peer dependency to `>=13.5.9` for CVE-2025-29927 (middleware
authorization bypass).
>
> Version bumps: Angular `0.25.5`; Next/Qwik `0.25.5`; React, React
Native, Solid, Svelte, Vue `5.2.4`. Pending changeset files under
`.changeset/` are removed as part of the release workflow.
>
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
a8b9547d52d1bfb9aca388bde43a726f46db540d. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> 27e443e1 📦 Publish SDKs (#4691)
This PR was opened by the [Changesets
release](https://github.com/changesets/action) GitHub action. When
you're ready to do a release, you can merge this and the packages will
be published to npm automatically. If you're not ready to do a release
yet, that's fine, whenever you add more changesets to main, this PR will
be updated.
# Releases
## @builder.io/sdk-angular@0.25.5
### Patch Changes
- 071f939: Stop injecting duplicate inline A/B test scripts on pages
with multiple Content components. The `window.builderIoAbTest` /
`window.builderIoRenderContent` init script is now only emitted when a
Content actually renders A/B variants, and the definition is idempotent
and self-removing on hydration targets. This avoids the duplication
without the client-side DOM mutation that caused the previous hydration
regression.
## @builder.io/sdk-react-nextjs@0.25.5
### Patch Changes
- 071f939: Stop injecting duplicate inline A/B test scripts on pages
with multiple Content components. The `window.builderIoAbTest` /
`window.builderIoRenderContent` init script is now only emitted when a
Content actually renders A/B variants, and the definition is idempotent
and self-removing on hydration targets. This avoids the duplication
without the client-side DOM mutation that caused the previous hydration
regression.
- 10b6707: Bump `next` peer dependency to `>=13.5.9` to address
authorization bypass in Next.js middleware (CVE-2025-29927)
## @builder.io/sdk-qwik@0.25.5
### Patch Changes
- 071f939: Stop injecting duplicate inline A/B test scripts on pages
with multiple Content components. The `window.builderIoAbTest` /
`window.builderIoRenderContent` init script is now only emitted when a
Content actually renders A/B variants, and the definition is idempotent
and self-removing on hydration targets. This avoids the duplication
without the client-side DOM mutation that caused the previous hydration
regression.
## @builder.io/sdk-react@5.2.4
### Patch Changes
- 071f939: Stop injecting duplicate inline A/B test scripts on pages
with multiple Content components. The `window.builderIoAbTest` /
`window.builderIoRenderContent` init script is now only emitted when a
Content actually renders A/B variants, and the definition is idempotent
and self-removing on hydration targets. This avoids the duplication
without the client-side DOM mutation that caused the previous hydration
regression.
## @builder.io/sdk-react-native@5.2.4
### Patch Changes
- 071f939: Stop injecting duplicate inline A/B test scripts on pages
with multiple Content components. The `window.builderIoAbTest` /
`window.builderIoRenderContent` init script is now only emitted when a
Content actually renders A/B variants, and the definition is idempotent
and self-removing on hydration targets. This avoids the duplication
without the client-side DOM mutation that caused the previous hydration
regression.
## @builder.io/sdk-solid@5.2.4
### Patch Changes
- 071f939: Stop injecting duplicate inline A/B test scripts on pages
with multiple Content components. The `window.builderIoAbTest` /
`window.builderIoRenderContent` init script is now only emitted when a
Content actually renders A/B variants, and the definition is idempotent
and self-removing on hydration targets. This avoids the duplication
without the client-side DOM mutation that caused the previous hydration
regression.
## @builder.io/sdk-svelte@5.2.4
### Patch Changes
- 071f939: Stop injecting duplicate inline A/B test scripts on pages
with multiple Content components. The `window.builderIoAbTest` /
`window.builderIoRenderContent` init script is now only emitted when a
Content actually renders A/B variants, and the definition is idempotent
and self-removing on hydration targets. This avoids the duplication
without the client-side DOM mutation that caused the previous hydration
regression.
## @builder.io/sdk-vue@5.2.4
### Patch Changes
- 071f939: Stop injecting duplicate inline A/B test scripts on pages
with multiple Content components. The `window.builderIoAbTest` /
`window.builderIoRenderContent` init script is now only emitted when a
Content actually renders A/B variants, and the definition is idempotent
and self-removing on hydration targets. This avoids the duplication
without the client-side DOM mutation that caused the previous hydration
regression.
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> **Medium Risk**
> A/B and SSR/hydration script behavior affects all framework SDK
consumers; the Next peer bump may block installs on vulnerable Next
versions until upgraded.
>
> **Overview**
> This **Changesets release PR** bumps published Gen2 SDK versions and
records patch notes; merging triggers npm publish.
>
> **A/B test inline script (all listed SDKs):** Re-applies the dedupe
fix after a prior revert—`window.builderIoAbTest` /
`window.builderIoRenderContent` init scripts are emitted only when
`Content` actually renders A/B variants, with idempotent definitions
that self-remove on hydration targets, avoiding duplicate scripts on
multi-`Content` pages without client-side DOM mutation that caused
hydration regressions.
>
> **Next.js SDK only (`@builder.io/sdk-react-nextjs@0.25.5`):** Raises
the `next` peer dependency to `>=13.5.9` for CVE-2025-29927 (middleware
authorization bypass).
>
> Version bumps: Angular `0.25.5`; Next/Qwik `0.25.5`; React, React
Native, Solid, Svelte, Vue `5.2.4`. Pending changeset files under
`.changeset/` are removed as part of the release workflow.
>
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
a8b9547d52d1bfb9aca388bde43a726f46db540d. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>