master-zapier-plan-draft/vendor/zapier-platform/packages/legacy-scripting-runner/CHANGELOG.md

4.0.8

• 🔨 Bump @xmldom/xmldom from 0.8.11 to 0.8.13 (#1286)

4.0.7

• 🔨 Bump underscore from 1.13.7 to 1.13.8 (#1256)
• 🔨 Bump lodash from 4.17.23 to 4.18.1 (#1274)

4.0.6

• 🐛 Declare optional peer dependency to fix pnpm strict module resolution (#1255)

4.0.5

Released 2026-02-26

• 🐛 Add explicit form-data dependency to work with pnpm strict module isolation (#1247)
• 🔨 Bump lodash from 4.17.21 to 4.17.23 (#1235)

4.0.1

Release 2025-11-14

• 🐛 fix "Template string must be a string" when auth mapping contains non-string values (#1195)

4.0.0

Released 2025-10-30

We updated several dependencies of legacy-scripting-runner to address security vulnerabilities. This includes a breaking change ❗ from underscore's _.template() function, where the _.template(templateString, data) usage is no longer supported. You will have to change your legacy scripting code to use _.template(templateString)(data) instead.

That's the only breaking change. For details and more dependency updates, see the PR linked below:

• ❗ Update underscore, lodash, xmldom (#1177)

3.8.18

Released 2025-07-17

• 🐛 Make sanitizeHeaders middleware an optional import (#1050)

3.8.17

• 🐛 Ensure z.request renders {{curlies}} on different zapier-platform-core versions (#1037)

3.8.16

• 🐛 sync z.request should log request_params (#1017)

3.8.15

• 🔨 Trim newline and whitespaces from request header (#1000)

3.8.14

• 🐛 Revert aws-sdk v2 bundling change from 3.8.13 (#916). This release is essentially the same as 3.8.12.

3.8.13

• 🔨 Add aws-sdk v2 to dependency list (#912)

3.8.11

• 🐛 sync z.request doesn't produce an HTTP log (#566)

3.8.10

• 🐛 Add support for StopRequestException in more methods (#561)

3.8.9

• 🐛 StopRequestException should be caught instead of thrown (#558)

3.8.8

• 🐛 Make logResponse import backward compatible to fix func.apply is not a function error (#548)

3.8.7

• 🐛 Replace deasync with synckit to fix hanging (#509)

3.8.6

• 🐛 Fix issues with file uploading (#496)
• 💅 Pass legacy.skipEncodingChars to z.request() (#501)

3.8.5

• 🐛 Prune nulls and undefined's from query params (#446)
• 🐛 Handle string array output from a scriptless create/action (#447)
• 🐛 Encode request.data in form-urlencoded for pre methods (#448)

3.8.4

• 🐛 Make sure redirect_uri is available during oauth2.refresh (#444)
• 🐛 Don't send auth with z.dehydrateFile(url, {}) (#445)

3.8.3

• 🐛 Fix empty auth params when merging request.url and reqeust.params (#441)

3.8.2

• 🐛 Merge request.url to request.params before making a request (#435)
• 🐛 Default to auth fields if auth mapping is empty (#438)

3.8.1

• 🐛 Add support for z.reqeust({ json: true, body: {...} }) (#418)
• 🐛 Empty request.data should send an empty request body instead of an empty object (#423)
• 🐛 Fix duplicate headers with session auth (#424)

3.8.0

• 🎉 Include isBulkRead to bundle.meta (#414)
• 🐛 Fix Cannot read property 'errors' of undefined on auth refresh (#410)
• 🐛 Fix JSON results array could not be located when a trigger response is "null" (#415)

3.7.17

• 🐛 Allow pre_write method to "cancel" multipart body by emptying request.files (#394)

3.7.16

• 🐛 Allow auth to be an object for z.request (#366)

3.7.15

• 🐛 Fix another edge case that can lead to duplicate API Key headers (#365)

3.7.14

• 🐛 Fix case-insesitive duplicate auth headers when using "API Key in Header" (#364)

3.7.13

• 🐛 inputData should take precedence over authData when auth fields are not saved yet (#359)

3.7.12

• 🐛 Add bundle.trigger_data to pre_subscribe and post_subscribe (#342)
• 🐛 Fix inconsistency with optional file fields (#344)

3.7.11

• 🐛 Yet-to-save auth fields should be in bundle.auth_fields (#331)

3.7.10

• 🐛 Fix pre_oauthv2_token and pre_oauthv2_refresh discrepancies (#329)

3.7.9

• 🐛 Throwing ErrorException should appear in an error log (#309)

3.7.8

• 🐛 Better choose between ResponseError and script error (#305)

3.7.7

• 🐛 Shouldn't double encode when pre method also encodes the URL (#304)

3.7.6

• 🐛 bundle.request.data should always be an object in pre_oauthv2_refresh (#294)

3.7.5

• 🐛 Make response headers case-insensitive (#253)
• 🐛 bundle.request.data should be undefined in pre_custom_action_fields (#256)

3.7.4

• 🐛 Fix env vars in curlies not resolving properly (#237)

3.7.3

• 🐛 Encode URL before sending a request (#235)
• 🔨 Refactor tests to use Zapier-hosted httpbin (#228)
• 🔨 Fix tests where inline function source isn't compiled (#226)

3.7.2

• 🐛 Prune body if allowGetBody and body is empty (#224)

3.7.1

• 🐛 Allow post_read_resource to return an array (#219)
• 🔨 Upgrade dependencies (#218)

3.7.0

• 🎉 More complete bundle logs (#213)
• 🐛 Trim bloated bundles for KEY_post methods (#213)

3.6.0

• 💅 Allow GET requests to have body (requires zapier-platform-core 9.4.0+) (#195)
• 🐛 More "reliably interpolate arrays or objects to a string" (#203)
• 🔨 Upgrade request package (#196)

3.5.0

• 🎉 Add support for unbounded curlies (#194)

3.4.0

• 🎉 Allow to "reliably interpolate arrays or objects to a string" (#190)

3.3.3

• 🐛 Run post method first before throwing error for response status (#183)

3.3.2

• 🐛 Fix missing console.log (#182)

3.3.1

• 🐛 Add full jQuery support (#181)

3.3.0

• 🎉 Log converted bundles (#177)