This release has two breaking changes: failed checks no longer include exception details in responses, and the deprecated WATCHMAN_TOKEN setting is removed.
Security
- GHSA-vwvx-6hm8-h27h Stop exposing exception messages and stacktraces from failed checks by default. Failed checks now return
{"ok": false, "error": "Check failed. See logs for details."}in the status endpoint, dashboard, andwatchmanmanagement command; full details are still logged via thewatchmanlogger. SetWATCHMAN_EXPOSE_ERROR_DETAILS = Trueto restore the previous behaviour. This changes the response format for failing checks — update any monitoring that parses theerrororstacktracefields.
Removed
- #233 Remove deprecated
WATCHMAN_TOKENsetting — useWATCHMAN_TOKENSinstead (deprecated since 0.11, removal planned for 1.0)