[Changed] Engineering: the monorepo has been migrated to Yarn 2 (Berry 4.18.0), and internal package dependencies now use the workspace:* protocol, which is automatically resolved to specific versions at publish time
[Changed] The release process has been switched to Lerna independent versioning mode, supporting incremental publishing per package (changes to @cloudbase/oauth automatically trigger the release of @cloudbase/auth and @cloudbase/js-sdk); all sub-packages are now public and can be published individually
[Fixed] Removed leftover debug console.log statements in @cloudbase/oauth (the CloudbaseOAuth constructor) and @cloudbase/mysql (getEntity)
[Fixed] Added missing getSecretInfo-related type assertions in the @cloudbase/app Node.js adapter
[Changed] Auth module: the usage value of the verification code API getVerification is now consistently narrowed to the VerificationUsage enum (EMAIL / RECOVERY / REAUTHENTICATION). Scenarios such as signUp, signInWithOtp, resetPasswordForEmail, updateUser, reauthenticate, and resend no longer use string literals, preventing incorrect values from being passed
[Changed] @cloudbase/oauth now additionally exports the VerificationUsage enum
[Changed] The type of the internal data.usage field in resend has been narrowed from string to VerificationUsage
[Fixed] Fundamentally resolved the Module not found: Can't resolve 'xxx' errors caused by optional Node.js dependencies (jsonwebtoken, @cloudbase/signature-nodejs, ws) when consumers bundle for the browser or SSR (Next.js, Nuxt, etc.): these dependencies are now loaded on demand at runtime by an internal optionalRequire, where the module name is assembled from fragments at runtime and require is obtained from the host runtime, so bundlers cannot recognize them during static analysis and therefore will not try to resolve them. Consumers no longer need to configure serverExternalPackages in next.config.js or add webpack fallbacks
[Changed] The wsClass of the Node.js adapter has been changed to a lazily-loaded getter: ws is loaded only when realtime capabilities (realtime / database) actually access this property, so Node.js scenarios that do not use realtime capabilities will not load ws; a duplicate-guard flag has also been added to avoid repeatedly executing the load and repeatedly printing the installation hint when ws is not installed
[Fixed] Fixed an issue where the private key passed by users via init({ env, auth: { credentials } }) could not be read by createTicket in custom login scenarios: getSecretInfo() previously only read from the top-level config.credentials, and now supports both config.auth.credentials (js-sdk style) and top-level credentials (node-sdk style)
[Fixed] Fixed an issue where dealNodeAdapterConfig() overwrote config.auth.credentials with an empty value when backfilling; it now preserves the credentials explicitly passed by the user, and corrects its fallback value type (an ICredentialsInfo object, undefined when there is no valid value, no longer an empty string)
[Changed] timeout default value now varies by runtime environment: Node.js environments (Cloud Functions/CloudBase Run/self-hosted servers) default to no timeout (unlimited) to accommodate long-running server-side requests; Web and other non-Node.js environments still default to 15000ms. Explicitly passing timeout takes precedence
[Changed] NodeRequest no longer applies timeout interruption when timeout is not set (download and createAbortController enable timeout on demand), only enabled when timeout is explicitly passed
[Changed] Auth updateUser no longer supports password changes: passing password / new_password parameters will throw an error. Use resetPasswordForOld (change with old password), resetPasswordForEmail (reset via verification code), or reauthenticate (change after re-authentication) instead
[Changed] UpdateUserReq type removes password / new_password fields from base request (marked as never)
[Fixed] In getSecretInfo(), when using top-level secretId/secretKey, sessionToken was incorrectly read from environment variable TENCENTCLOUD_SESSIONTOKEN, corrected to read from top-level sessionToken field in config
[Fixed] In getSecretInfo(), when using config.auth, sessionToken was incorrectly read from environment variable, corrected to read from config.auth.sessionToken
[Fixed] NodeRequest V3 signing now correctly resolves secretId/secretKey/sessionToken from both top-level config and config.auth (config.auth takes higher priority)
[Fixed] AI module: prioritize native Web Streams API (Node.js >= 18 / modern browsers) to avoid compatibility issues with web-streams-polyfill in higher version environments
[Fixed] Fixed the issue where webpack.DefinePlugin replaces process.env entirely with a static object during Node.js server build, causing runtime inability to read environment variables such as TENCENTCLOUD_SECRETID, TENCENTCLOUD_SECRETKEY, SCF_NAMESPACE
[Fixed] getSecretInfo() now reads from getCloudbaseContext() uniformly (instead of directly from getEnv()), ensuring correct priority of environment variables in context
[Fixed] getCloudbaseContext() adds collection of CLOUDBASE_APIKEY environment variable
[Fixed] AI module: in Node.js adapter non-streaming scenarios, when responseData is already a JSON object, skip ReadableStream parsing and return the result directly
[Fixed] Fixed the issue where getWxDefaultAdapter returns an empty object during initialization in Node.js ESM environment, causing useAdapters to throw TypeError: i is not a function when calling isMatch()
[Fixed] Fixed the issue where document database collection query in GATEWAY mode fails because backend response lacks the list field, causing formatResDocumentData to throw TypeError: Cannot read properties of undefined (reading 'map')
[Added] App instance adds registerHost(host, protocol?) method to set all endpoints (CLOUD_API / GATEWAY) at once, only requires the host address and automatically appends paths
[Fixed] Fixed the issue where CloudbaseRequest.fetch fails due to missing oauthInstance in Node.js server-side (secretId/secretKey authentication) scenario, enabling modules like RDB to correctly obtain access_token automatically through the underlying NodeRequest V3 signature
[Changed] app.storage.from() without arguments still returns ClassicStorageFileApi (behavior unchanged); passing bucketId returns the Neo object storage client
[Deprecated] Legacy top-level cloud storage APIs (uploadFile / downloadFile / deleteFile, etc.) are marked as deprecated, recommend using the new app.storage.from(bucketId) API instead
[Changed] getUser/getCurrentUser supports isRefresh parameter to control whether to fetch the latest user information via API request, defaults to fetching latest data each time