chore(main): release 2.1.0

[github-actions]

🤖 I have created a release beep boop

2.1.0 (2026-08-18)

Fixed

• deps: raise stale security override floors and unbreak minimatch brace expansion (#333) (2894b7c)
• deps: repo-wide dependency refresh, bound override floors both ways, carry cause on rethrown errors (#320) (dde9a9d)
• frame: initializeB24Frame() no longer strands callers or leaks a frame on failed init (#142) (#306) (530fcf6)
• http: stop a logging TypeError from destroying the request outcome (#345) (5980797)
• logger: isolate logging failures from the operation being logged (#348) (f2b5bcd), closes #346
• playground/cli: smoke-retry probes server.time, not user.current (#286) (000fb6d)
• pull: harden PullClient lifecycle — SSR safety, unified teardown, in-flight start() abort (#222) (#305) (087d962)

Security

• auth: timeout-bounded frame refreshAuth + non-enumerable SdkError.originalError (#189) (#304) (8f2b79b)
• http: redact credentials in the post/response success log (#69) (#287) (93170e6)
• scripts: harden b24-self-task agent against prompt injection (#179) (#289) (f4fe592)

Dependencies

• bump the npm-minor-patch group across 1 directory with 2 updates (#321) (32c5256)
• minor/patch refresh across 28 packages, with the three fixes it needs (#335) (fc9a63e)
• minor/patch refresh, with reka-ui left to follow @bitrix24/b24ui-nuxt (#339) (b5cb45b)
• take js-yaml 5, with the named-import migration it requires (#344) (222856e)

Changed

• frame: collapse initializeB24Frame() poll+booleans into one shared init promise (#142 follow-up) (#307) (881a168)
• tools: document Text/Type/Browser/useFormatter, fix getUniqId & isTypedArray (#292) (09439dc)

Docs

• @comark/vue ^0.3.1 -> ^0.5.1 and @nuxtjs/mcp-toolkit ^0.16.1 -> ^0.18.0. (32c5256)
• align audited with the #320 commit date on 5 pages so docs-lint --strict is green (#322) (5ffbd9e)
• correct the hand-maintained-CHANGELOG truth + fix v1.0.2 date (#178) (#311) (502c53e)
• defer legacy REST surface removal to 3.0.0 + migration guide (#278) (66cb378)
• drive homepage Cookbook + catalogue from the content collection (#105) (#298) (9924322)
• filtering reference (#77), setRestrictionManagerParams scope gotcha (#82), redaction-contract jsdoc (#73) (#294) (9de8255)
• frame: re-audit frame/pull pages — fix 4 drifts + refresh audited (#299) (#301) (28ac84f)
• lint and pnpm audit --audit-level=moderate all pass. (222856e)
• pin-b24sdk-examples-to-tags convention (#120) + cross-link logging page in CHANGELOG (#72) (#300) (a0e01a6)
• reference: document public tools/ + types/ — common, payloads, object helpers, environment (#125) (#303) (421fb2c)
• releasing: correct the handover — bootstrap-sha does not limit the scan (#354) (91e9e7f), closes #347
• scripts: replace hand-rolled frontmatter parser with js-yaml (#63) (#297) (34736f6)
• security patterns page for event receivers (#84) + skill install methods (#124) (#302) (7166c0c)

Tests

• pin batchByChunk item shape (#56) and selectCRM Record→Array BC (#57) (#293) (f0fde01)

CI

• bump pnpm/action-setup from 6.0.9 to 6.0.10 in the github-actions group (#329) (78df8d7)
• bump the github-actions group with 2 updates (#318) (c90be1f)
• dependabot: ignore three majors blocked by upstream peer ranges (#343) (1e2f394)
• release: add release-please, keeping the two OIDC publish workflows untouched (#352) (67c9249), closes #347
• security: audit prod+dev deps at moderate threshold (#110) (#288) (26f077c)

Chore

• bump pnpm 11.4.0 → 11.22.0 (#350) (ff7007d)
• markdownlint: enable MD060 + extend lint:md to skills/ and root docs (#266) (#295) (35f0f03)

---

This PR was generated with Release Please. See documentation.