From c6da2e61c68081aa6b089757bce7bff0d674055e Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Tue, 5 May 2026 01:47:38 +0000
Subject: [PATCH] Updated NPM changelogs

---
 .changeset/auto-enter-vr.md               |  5 -----
 .changeset/cold-toys-arrive.md            |  6 ------
 .changeset/cors-signalling-api.md         |  6 ------
 .changeset/double-click-release.md        |  6 ------
 .changeset/heavy-masks-mate.md            |  9 ---------
 .changeset/macos-cmd-keys.md              |  5 -----
 .changeset/mediasoup-sdp-bridge-3.10.md   |  5 -----
 .changeset/mouse-capture-outside-video.md |  5 -----
 .changeset/quiet-foxes-dance.md           |  9 ---------
 .changeset/silent-lemons-shine.md         |  6 ------
 Common/CHANGELOG.md                       |  8 ++++++++
 Common/package.json                       |  2 +-
 Extras/mediasoup-sdp-bridge/CHANGELOG.md  |  7 +++++++
 Extras/mediasoup-sdp-bridge/package.json  |  2 +-
 Frontend/library/CHANGELOG.md             | 19 +++++++++++++++++++
 Frontend/library/package.json             |  4 ++--
 Frontend/ui-library/CHANGELOG.md          | 21 +++++++++++++++++++++
 Frontend/ui-library/package.json          |  4 ++--
 Signalling/CHANGELOG.md                   | 16 ++++++++++++++++
 Signalling/package.json                   |  4 ++--
 SignallingWebServer/CHANGELOG.md          | 17 ++++++++++++++++-
 SignallingWebServer/package.json          |  2 +-
 22 files changed, 96 insertions(+), 72 deletions(-)
 delete mode 100644 .changeset/auto-enter-vr.md
 delete mode 100644 .changeset/cold-toys-arrive.md
 delete mode 100644 .changeset/cors-signalling-api.md
 delete mode 100644 .changeset/double-click-release.md
 delete mode 100644 .changeset/heavy-masks-mate.md
 delete mode 100644 .changeset/macos-cmd-keys.md
 delete mode 100644 .changeset/mediasoup-sdp-bridge-3.10.md
 delete mode 100644 .changeset/mouse-capture-outside-video.md
 delete mode 100644 .changeset/quiet-foxes-dance.md
 delete mode 100644 .changeset/silent-lemons-shine.md
 create mode 100644 Extras/mediasoup-sdp-bridge/CHANGELOG.md

diff --git a/.changeset/auto-enter-vr.md b/.changeset/auto-enter-vr.md
deleted file mode 100644
index 0e67170f2..000000000
--- a/.changeset/auto-enter-vr.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"@epicgames-ps/lib-pixelstreamingfrontend-ue5.7": minor
----
-
-Add an `AutoEnterVR` config flag (#461). When enabled, the player checks for `immersive-vr` support after the video is initialized and requests the WebXR session automatically. Default is off. Note: browsers may require a user gesture to start a WebXR session; in flows where there is no pending gesture (for example, a fresh-page-load `AutoConnect`) the request can still be rejected and the player will log a warning.
diff --git a/.changeset/cold-toys-arrive.md b/.changeset/cold-toys-arrive.md
deleted file mode 100644
index f2cc31da9..000000000
--- a/.changeset/cold-toys-arrive.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-'@epicgames-ps/lib-pixelstreamingfrontend-ui-ue5.7': minor
-'@epicgames-ps/lib-pixelstreamingfrontend-ue5.7': minor
----
-
-Added Viewport Resolution Scale parameter to request higher resolution streams on small screens
diff --git a/.changeset/cors-signalling-api.md b/.changeset/cors-signalling-api.md
deleted file mode 100644
index c07037c21..000000000
--- a/.changeset/cors-signalling-api.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-"@epicgames-ps/lib-pixelstreamingsignalling-ue5.7": minor
-"@epicgames-ps/wilbur": minor
----
-
-Add CORS support to the signalling web server. A new `IWebServerConfig.cors` option registers the `cors` Express middleware before the rate limiter and any route handlers, so that custom frontends hosted on a different origin can call the REST API (`--rest_api`) or any other route mounted on the app. Wilbur exposes this through a `--cors` CLI flag (default off) plus `--cors_allowed_origins`, `--cors_allowed_methods`, `--cors_allowed_headers`, and `--cors_credentials`. All four sub-options accept comma-separated values and read matching `cors*` keys from `config.json`. When `--cors` is set without an explicit origin list, all origins are allowed.
diff --git a/.changeset/double-click-release.md b/.changeset/double-click-release.md
deleted file mode 100644
index 74fc296a3..000000000
--- a/.changeset/double-click-release.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-"@epicgames-ps/lib-pixelstreamingfrontend-ue5.7": patch
-"@epicgames-ps/lib-pixelstreamingfrontend-ui-ue5.7": patch
----
-
-Synthesize a `MouseUp` after `MouseDouble` in both mouse controllers so the streamer's pressed-button state stays balanced after a double-click (#10). The plugin treats `MouseDouble` as a press-class event (`RoutePointerDoubleClickEvent` / `IGenericApplicationMessageHandler::OnMouseDoubleClick`) but never synthesizes a release; the browser's preceding `mouseup` was already consumed by the prior `MouseUp`, so UE was left thinking the button was still held — manifesting, for example, as camera pans that latched on after a double-click. Behaviour is gated on the new `MouseDoubleClickAutoRelease` flag (default on); disable it via `?MouseDoubleClickAutoRelease=false` or the settings panel to restore pre-fix behaviour for projects that handle the doubleclick release themselves.
diff --git a/.changeset/heavy-masks-mate.md b/.changeset/heavy-masks-mate.md
deleted file mode 100644
index a428e973f..000000000
--- a/.changeset/heavy-masks-mate.md
+++ /dev/null
@@ -1,9 +0,0 @@
----
-'@epicgames-ps/lib-pixelstreamingfrontend-ui-ue5.7': patch
-'@epicgames-ps/lib-pixelstreamingfrontend-ue5.7': patch
-'@epicgames-ps/lib-pixelstreamingsignalling-ue5.7': patch
-'@epicgames-ps/lib-pixelstreamingcommon-ue5.7': patch
----
-
-- Addressing security issues raised by dependabot. (glob, js-yaml, playwright)
-- Added lint npm script to the root project. Running `npm run lint` will now run linting over all packages.
diff --git a/.changeset/macos-cmd-keys.md b/.changeset/macos-cmd-keys.md
deleted file mode 100644
index 2999fef20..000000000
--- a/.changeset/macos-cmd-keys.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"@epicgames-ps/lib-pixelstreamingfrontend-ue5.7": patch
----
-
-Map the macOS Command (and Windows Meta) keys to UE keycodes 91 (`LeftWindowKey`) and 92 (`RightWindowKey`). `KeyCodes.ts` now contains `MetaLeft`/`MetaRight` (and the legacy `OSLeft`/`OSRight`) entries, and `KeyboardController.getKeycode` normalizes the right-Cmd code so it no longer collides with `ContextMenu` (93) on browsers that report `keyCode === 93` for it, and so Firefox-on-Mac (which reports `keyCode === 224` for both Cmds) is also handled. Frontend portion of issue #276 — UE-side support for these key codes is tracked separately.
diff --git a/.changeset/mediasoup-sdp-bridge-3.10.md b/.changeset/mediasoup-sdp-bridge-3.10.md
deleted file mode 100644
index da7f261ee..000000000
--- a/.changeset/mediasoup-sdp-bridge-3.10.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"@epicgames-ps/mediasoup-sdp-bridge": patch
----
-
-Make `mediasoup-sdp-bridge` importable against `mediasoup-client` 3.10.x (#685). Internal subpaths under `mediasoup-client/lib/...` were hidden by the `exports` field added in 3.8.0, breaking `import * as MsSdpUtils from "mediasoup-client/lib/handlers/sdp/commonUtils"` etc. with `ERR_PACKAGE_PATH_NOT_EXPORTED`. The imports now use the public paths exposed since 3.10.0 (`mediasoup-client/handlers/sdp/commonUtils`, `mediasoup-client/handlers/sdp/RemoteSdp`, `mediasoup-client/handlers/sdp/unifiedPlanUtils`, `mediasoup-client/ortc`) and the publicly re-exported `IceCandidate` from `mediasoup-client/types`. The peerDependency is tightened to `>=3.10.0 <3.11.0` to flag the supported range — 3.11 added a mandatory third arg to `getExtendedRtpCapabilities` and 3.16 renamed `validateRtpCapabilities`, both of which need follow-up work before they can be supported. The unsupported `extmapAllowMixed` option on `RemoteSdp.send` was removed.
diff --git a/.changeset/mouse-capture-outside-video.md b/.changeset/mouse-capture-outside-video.md
deleted file mode 100644
index f9d737adb..000000000
--- a/.changeset/mouse-capture-outside-video.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"@epicgames-ps/lib-pixelstreamingfrontend-ue5.7": patch
----
-
-Fix mouse-button-held tracking so dragging outside the video element keeps sending move and release events to UE (#349). When a button is pressed on the hovering mouse controller, `mousemove`/`mouseup` are temporarily moved from the video element to `window`, with coordinates re-computed against the video element's bounding rect. When all buttons are released, the listeners switch back to the element. This prevents the engine from being left with a stuck button when the user releases outside the video — common with `DefaultViewportMouseCaptureMode=CaptureDuringMouseDown`.
diff --git a/.changeset/quiet-foxes-dance.md b/.changeset/quiet-foxes-dance.md
deleted file mode 100644
index a76962ef4..000000000
--- a/.changeset/quiet-foxes-dance.md
+++ /dev/null
@@ -1,9 +0,0 @@
----
-"@epicgames-ps/lib-pixelstreamingcommon-ue5.7": patch
-"@epicgames-ps/lib-pixelstreamingsignalling-ue5.7": patch
-"@epicgames-ps/wilbur": patch
-"@epicgames-ps/lib-pixelstreamingfrontend-ue5.7": patch
-"@epicgames-ps/lib-pixelstreamingfrontend-ui-ue5.7": patch
----
-
-Make `npm run lint` work regardless of the directory it's invoked from. Each workspace's `eslint.config.mjs` now pins `parserOptions.tsconfigRootDir` to `import.meta.dirname`, so `parserOptions.project` resolves relative to the config file's own directory rather than whichever CWD `typescript-eslint` happens to pick by default. Previously the six workspace configs prefixed `project` with the workspace directory (e.g. `'Common/tsconfig.cjs.json'`), which only worked under one specific `typescript-eslint` version's resolution behavior and broke CI when run from within the workspace.
diff --git a/.changeset/silent-lemons-shine.md b/.changeset/silent-lemons-shine.md
deleted file mode 100644
index 1cdc9a65a..000000000
--- a/.changeset/silent-lemons-shine.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-"@epicgames-ps/wilbur": patch
-"@epicgames-ps/lib-pixelstreamingsignalling-ue5.7": minor
----
-
-Make the REST API reachable when Wilbur is started with `--rest_api` but without `--serve`. Previously the Express app that hosts the `/api/*` routes was only bound to an HTTP listener inside the `serve` branch, so with `--serve=false --rest_api=true` the listener never started and requests were answered by the WebSocket upgrade handler on the player port (`426 Upgrade Required`). The HTTP listener now starts whenever `rest_api` or `serve` is set. Static file serving and the homepage route are gated by a new `IWebServerConfig.serveStatic` flag (the port listener runs independently of static serving), and the rate limiter is registered before any route handlers so the homepage and any downstream-registered routes are all rate-limited. Wilbur logs at startup which mode it is running in.
diff --git a/Common/CHANGELOG.md b/Common/CHANGELOG.md
index 9ec9be5a4..3eea8a30b 100644
--- a/Common/CHANGELOG.md
+++ b/Common/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @epicgames-ps/lib-pixelstreamingcommon-ue5.6
 
+## 0.1.5
+
+### Patch Changes
+
+- c3e46a8: - Addressing security issues raised by dependabot. (glob, js-yaml, playwright)
+    - Added lint npm script to the root project. Running `npm run lint` will now run linting over all packages.
+- 5696f2e: Make `npm run lint` work regardless of the directory it's invoked from. Each workspace's `eslint.config.mjs` now pins `parserOptions.tsconfigRootDir` to `import.meta.dirname`, so `parserOptions.project` resolves relative to the config file's own directory rather than whichever CWD `typescript-eslint` happens to pick by default. Previously the six workspace configs prefixed `project` with the workspace directory (e.g. `'Common/tsconfig.cjs.json'`), which only worked under one specific `typescript-eslint` version's resolution behavior and broke CI when run from within the workspace.
+
 ## 0.1.4
 
 ### Patch Changes
diff --git a/Common/package.json b/Common/package.json
index 0d800aff9..05051f5b0 100644
--- a/Common/package.json
+++ b/Common/package.json
@@ -1,6 +1,6 @@
 {
     "name": "@epicgames-ps/lib-pixelstreamingcommon-ue5.7",
-    "version": "0.1.4",
+    "version": "0.1.5",
     "description": "Common utilities library for Unreal Engine 5.7 Pixel Streaming",
     "main": "dist/cjs/pixelstreamingcommon.js",
     "module": "dist/esm/pixelstreamingcommon.js",
diff --git a/Extras/mediasoup-sdp-bridge/CHANGELOG.md b/Extras/mediasoup-sdp-bridge/CHANGELOG.md
new file mode 100644
index 000000000..1012b4f64
--- /dev/null
+++ b/Extras/mediasoup-sdp-bridge/CHANGELOG.md
@@ -0,0 +1,7 @@
+# @epicgames-ps/mediasoup-sdp-bridge
+
+## 1.0.6
+
+### Patch Changes
+
+- 2af38ec: Make `mediasoup-sdp-bridge` importable against `mediasoup-client` 3.10.x (#685). Internal subpaths under `mediasoup-client/lib/...` were hidden by the `exports` field added in 3.8.0, breaking `import * as MsSdpUtils from "mediasoup-client/lib/handlers/sdp/commonUtils"` etc. with `ERR_PACKAGE_PATH_NOT_EXPORTED`. The imports now use the public paths exposed since 3.10.0 (`mediasoup-client/handlers/sdp/commonUtils`, `mediasoup-client/handlers/sdp/RemoteSdp`, `mediasoup-client/handlers/sdp/unifiedPlanUtils`, `mediasoup-client/ortc`) and the publicly re-exported `IceCandidate` from `mediasoup-client/types`. The peerDependency is tightened to `>=3.10.0 <3.11.0` to flag the supported range — 3.11 added a mandatory third arg to `getExtendedRtpCapabilities` and 3.16 renamed `validateRtpCapabilities`, both of which need follow-up work before they can be supported. The unsupported `extmapAllowMixed` option on `RemoteSdp.send` was removed.
diff --git a/Extras/mediasoup-sdp-bridge/package.json b/Extras/mediasoup-sdp-bridge/package.json
index fda645df7..0abd035ba 100644
--- a/Extras/mediasoup-sdp-bridge/package.json
+++ b/Extras/mediasoup-sdp-bridge/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@epicgames-ps/mediasoup-sdp-bridge",
   "private": true,
-  "version": "1.0.5",
+  "version": "1.0.6",
   "description": "Node.js library to allow integration of SDP based clients with mediasoup",
   "contributors": [
     "Iñaki Baz Castillo <ibc@aliax.net> (https://inakibaz.me)",
diff --git a/Frontend/library/CHANGELOG.md b/Frontend/library/CHANGELOG.md
index 89d1f3a70..9dc1bea4b 100644
--- a/Frontend/library/CHANGELOG.md
+++ b/Frontend/library/CHANGELOG.md
@@ -1,5 +1,24 @@
 # @epicgames-ps/lib-pixelstreamingfrontend-ue5.6
 
+## 0.3.0
+
+### Minor Changes
+
+- 9a3404c: Add an `AutoEnterVR` config flag (#461). When enabled, the player checks for `immersive-vr` support after the video is initialized and requests the WebXR session automatically. Default is off. Note: browsers may require a user gesture to start a WebXR session; in flows where there is no pending gesture (for example, a fresh-page-load `AutoConnect`) the request can still be rejected and the player will log a warning.
+- 72c5c53: Added Viewport Resolution Scale parameter to request higher resolution streams on small screens
+
+### Patch Changes
+
+- e120706: Synthesize a `MouseUp` after `MouseDouble` in both mouse controllers so the streamer's pressed-button state stays balanced after a double-click (#10). The plugin treats `MouseDouble` as a press-class event (`RoutePointerDoubleClickEvent` / `IGenericApplicationMessageHandler::OnMouseDoubleClick`) but never synthesizes a release; the browser's preceding `mouseup` was already consumed by the prior `MouseUp`, so UE was left thinking the button was still held — manifesting, for example, as camera pans that latched on after a double-click. Behaviour is gated on the new `MouseDoubleClickAutoRelease` flag (default on); disable it via `?MouseDoubleClickAutoRelease=false` or the settings panel to restore pre-fix behaviour for projects that handle the doubleclick release themselves.
+- c3e46a8: - Addressing security issues raised by dependabot. (glob, js-yaml, playwright)
+    - Added lint npm script to the root project. Running `npm run lint` will now run linting over all packages.
+- 1a2a621: Map the macOS Command (and Windows Meta) keys to UE keycodes 91 (`LeftWindowKey`) and 92 (`RightWindowKey`). `KeyCodes.ts` now contains `MetaLeft`/`MetaRight` (and the legacy `OSLeft`/`OSRight`) entries, and `KeyboardController.getKeycode` normalizes the right-Cmd code so it no longer collides with `ContextMenu` (93) on browsers that report `keyCode === 93` for it, and so Firefox-on-Mac (which reports `keyCode === 224` for both Cmds) is also handled. Frontend portion of issue #276 — UE-side support for these key codes is tracked separately.
+- d932cd9: Fix mouse-button-held tracking so dragging outside the video element keeps sending move and release events to UE (#349). When a button is pressed on the hovering mouse controller, `mousemove`/`mouseup` are temporarily moved from the video element to `window`, with coordinates re-computed against the video element's bounding rect. When all buttons are released, the listeners switch back to the element. This prevents the engine from being left with a stuck button when the user releases outside the video — common with `DefaultViewportMouseCaptureMode=CaptureDuringMouseDown`.
+- 5696f2e: Make `npm run lint` work regardless of the directory it's invoked from. Each workspace's `eslint.config.mjs` now pins `parserOptions.tsconfigRootDir` to `import.meta.dirname`, so `parserOptions.project` resolves relative to the config file's own directory rather than whichever CWD `typescript-eslint` happens to pick by default. Previously the six workspace configs prefixed `project` with the workspace directory (e.g. `'Common/tsconfig.cjs.json'`), which only worked under one specific `typescript-eslint` version's resolution behavior and broke CI when run from within the workspace.
+- Updated dependencies [c3e46a8]
+- Updated dependencies [5696f2e]
+    - @epicgames-ps/lib-pixelstreamingcommon-ue5.7@0.1.5
+
 ## 0.2.2
 
 ### Patch Changes
diff --git a/Frontend/library/package.json b/Frontend/library/package.json
index f493a5ce0..c44b4eb95 100644
--- a/Frontend/library/package.json
+++ b/Frontend/library/package.json
@@ -1,6 +1,6 @@
 {
     "name": "@epicgames-ps/lib-pixelstreamingfrontend-ue5.7",
-    "version": "0.2.2",
+    "version": "0.3.0",
     "description": "Frontend library for Unreal Engine 5.7 Pixel Streaming",
     "main": "dist/cjs/pixelstreamingfrontend.js",
     "module": "dist/esm/pixelstreamingfrontend.js",
@@ -33,7 +33,7 @@
         "@types/node": "^22.14.0"
     },
     "dependencies": {
-        "@epicgames-ps/lib-pixelstreamingcommon-ue5.7": "^0.1.4",
+        "@epicgames-ps/lib-pixelstreamingcommon-ue5.7": "^0.1.5",
         "sdp": "^3.2.0"
     },
     "repository": {
diff --git a/Frontend/ui-library/CHANGELOG.md b/Frontend/ui-library/CHANGELOG.md
index bfa86f890..da6bb2876 100644
--- a/Frontend/ui-library/CHANGELOG.md
+++ b/Frontend/ui-library/CHANGELOG.md
@@ -1,5 +1,26 @@
 # @epicgames-ps/lib-pixelstreamingfrontend-ui-ue5.6
 
+## 0.2.0
+
+### Minor Changes
+
+- 72c5c53: Added Viewport Resolution Scale parameter to request higher resolution streams on small screens
+
+### Patch Changes
+
+- e120706: Synthesize a `MouseUp` after `MouseDouble` in both mouse controllers so the streamer's pressed-button state stays balanced after a double-click (#10). The plugin treats `MouseDouble` as a press-class event (`RoutePointerDoubleClickEvent` / `IGenericApplicationMessageHandler::OnMouseDoubleClick`) but never synthesizes a release; the browser's preceding `mouseup` was already consumed by the prior `MouseUp`, so UE was left thinking the button was still held — manifesting, for example, as camera pans that latched on after a double-click. Behaviour is gated on the new `MouseDoubleClickAutoRelease` flag (default on); disable it via `?MouseDoubleClickAutoRelease=false` or the settings panel to restore pre-fix behaviour for projects that handle the doubleclick release themselves.
+- c3e46a8: - Addressing security issues raised by dependabot. (glob, js-yaml, playwright)
+    - Added lint npm script to the root project. Running `npm run lint` will now run linting over all packages.
+- 5696f2e: Make `npm run lint` work regardless of the directory it's invoked from. Each workspace's `eslint.config.mjs` now pins `parserOptions.tsconfigRootDir` to `import.meta.dirname`, so `parserOptions.project` resolves relative to the config file's own directory rather than whichever CWD `typescript-eslint` happens to pick by default. Previously the six workspace configs prefixed `project` with the workspace directory (e.g. `'Common/tsconfig.cjs.json'`), which only worked under one specific `typescript-eslint` version's resolution behavior and broke CI when run from within the workspace.
+- Updated dependencies [9a3404c]
+- Updated dependencies [72c5c53]
+- Updated dependencies [e120706]
+- Updated dependencies [c3e46a8]
+- Updated dependencies [1a2a621]
+- Updated dependencies [d932cd9]
+- Updated dependencies [5696f2e]
+    - @epicgames-ps/lib-pixelstreamingfrontend-ue5.7@0.3.0
+
 ## 0.1.3
 
 ### Patch Changes
diff --git a/Frontend/ui-library/package.json b/Frontend/ui-library/package.json
index b3e06cfa1..5645bc069 100644
--- a/Frontend/ui-library/package.json
+++ b/Frontend/ui-library/package.json
@@ -1,6 +1,6 @@
 {
     "name": "@epicgames-ps/lib-pixelstreamingfrontend-ui-ue5.7",
-    "version": "0.1.3",
+    "version": "0.2.0",
     "description": "Reference frontend UI library for Unreal Engine 5.7 Pixel Streaming - gives the stock look and feel.",
     "main": "dist/cjs/pixelstreamingfrontend-ui.js",
     "module": "dist/esm/pixelstreamingfrontend-ui.js",
@@ -26,7 +26,7 @@
         "typescript-eslint": "8.57.2"
     },
     "dependencies": {
-        "@epicgames-ps/lib-pixelstreamingfrontend-ue5.7": "^0.2.2",
+        "@epicgames-ps/lib-pixelstreamingfrontend-ue5.7": "^0.3.0",
         "@babel/runtime": "^7.26.10",
         "jss": "^10.10.0",
         "jss-plugin-camel-case": "^10.10.0",
diff --git a/Signalling/CHANGELOG.md b/Signalling/CHANGELOG.md
index c263a833d..22292b1ce 100644
--- a/Signalling/CHANGELOG.md
+++ b/Signalling/CHANGELOG.md
@@ -1,5 +1,21 @@
 # @epicgames-ps/lib-pixelstreamingsignalling-ue5.6
 
+## 0.3.0
+
+### Minor Changes
+
+- b0550d4: Add CORS support to the signalling web server. A new `IWebServerConfig.cors` option registers the `cors` Express middleware before the rate limiter and any route handlers, so that custom frontends hosted on a different origin can call the REST API (`--rest_api`) or any other route mounted on the app. Wilbur exposes this through a `--cors` CLI flag (default off) plus `--cors_allowed_origins`, `--cors_allowed_methods`, `--cors_allowed_headers`, and `--cors_credentials`. All four sub-options accept comma-separated values and read matching `cors*` keys from `config.json`. When `--cors` is set without an explicit origin list, all origins are allowed.
+- 9308aa4: Make the REST API reachable when Wilbur is started with `--rest_api` but without `--serve`. Previously the Express app that hosts the `/api/*` routes was only bound to an HTTP listener inside the `serve` branch, so with `--serve=false --rest_api=true` the listener never started and requests were answered by the WebSocket upgrade handler on the player port (`426 Upgrade Required`). The HTTP listener now starts whenever `rest_api` or `serve` is set. Static file serving and the homepage route are gated by a new `IWebServerConfig.serveStatic` flag (the port listener runs independently of static serving), and the rate limiter is registered before any route handlers so the homepage and any downstream-registered routes are all rate-limited. Wilbur logs at startup which mode it is running in.
+
+### Patch Changes
+
+- c3e46a8: - Addressing security issues raised by dependabot. (glob, js-yaml, playwright)
+    - Added lint npm script to the root project. Running `npm run lint` will now run linting over all packages.
+- 5696f2e: Make `npm run lint` work regardless of the directory it's invoked from. Each workspace's `eslint.config.mjs` now pins `parserOptions.tsconfigRootDir` to `import.meta.dirname`, so `parserOptions.project` resolves relative to the config file's own directory rather than whichever CWD `typescript-eslint` happens to pick by default. Previously the six workspace configs prefixed `project` with the workspace directory (e.g. `'Common/tsconfig.cjs.json'`), which only worked under one specific `typescript-eslint` version's resolution behavior and broke CI when run from within the workspace.
+- Updated dependencies [c3e46a8]
+- Updated dependencies [5696f2e]
+    - @epicgames-ps/lib-pixelstreamingcommon-ue5.7@0.1.5
+
 ## 0.2.1
 
 ### Patch Changes
diff --git a/Signalling/package.json b/Signalling/package.json
index f823a8b01..9913482bd 100644
--- a/Signalling/package.json
+++ b/Signalling/package.json
@@ -1,6 +1,6 @@
 {
     "name": "@epicgames-ps/lib-pixelstreamingsignalling-ue5.7",
-    "version": "0.2.1",
+    "version": "0.3.0",
     "description": "Basic signalling library for developers wishing to build applications that signal a Pixel Streaming application.",
     "main": "dist/cjs/pixelstreamingsignalling.js",
     "module": "dist/esm/pixelstreamingsignalling.js",
@@ -49,7 +49,7 @@
         "ws": "^8.18.0"
     },
     "peerDependencies": {
-        "@epicgames-ps/lib-pixelstreamingcommon-ue5.7": "^0.1.4"
+        "@epicgames-ps/lib-pixelstreamingcommon-ue5.7": "^0.1.5"
     },
     "repository": {
         "type": "git",
diff --git a/SignallingWebServer/CHANGELOG.md b/SignallingWebServer/CHANGELOG.md
index 94c7ec41e..d955517ee 100644
--- a/SignallingWebServer/CHANGELOG.md
+++ b/SignallingWebServer/CHANGELOG.md
@@ -1,11 +1,26 @@
 # @epicgames-ps/wilbur
 
+## 3.1.0
+
+### Minor Changes
+
+- b0550d4: Add CORS support to the signalling web server. A new `IWebServerConfig.cors` option registers the `cors` Express middleware before the rate limiter and any route handlers, so that custom frontends hosted on a different origin can call the REST API (`--rest_api`) or any other route mounted on the app. Wilbur exposes this through a `--cors` CLI flag (default off) plus `--cors_allowed_origins`, `--cors_allowed_methods`, `--cors_allowed_headers`, and `--cors_credentials`. All four sub-options accept comma-separated values and read matching `cors*` keys from `config.json`. When `--cors` is set without an explicit origin list, all origins are allowed.
+
+### Patch Changes
+
+- 5696f2e: Make `npm run lint` work regardless of the directory it's invoked from. Each workspace's `eslint.config.mjs` now pins `parserOptions.tsconfigRootDir` to `import.meta.dirname`, so `parserOptions.project` resolves relative to the config file's own directory rather than whichever CWD `typescript-eslint` happens to pick by default. Previously the six workspace configs prefixed `project` with the workspace directory (e.g. `'Common/tsconfig.cjs.json'`), which only worked under one specific `typescript-eslint` version's resolution behavior and broke CI when run from within the workspace.
+- 9308aa4: Make the REST API reachable when Wilbur is started with `--rest_api` but without `--serve`. Previously the Express app that hosts the `/api/*` routes was only bound to an HTTP listener inside the `serve` branch, so with `--serve=false --rest_api=true` the listener never started and requests were answered by the WebSocket upgrade handler on the player port (`426 Upgrade Required`). The HTTP listener now starts whenever `rest_api` or `serve` is set. Static file serving and the homepage route are gated by a new `IWebServerConfig.serveStatic` flag (the port listener runs independently of static serving), and the rate limiter is registered before any route handlers so the homepage and any downstream-registered routes are all rate-limited. Wilbur logs at startup which mode it is running in.
+- Updated dependencies [b0550d4]
+- Updated dependencies [c3e46a8]
+- Updated dependencies [5696f2e]
+- Updated dependencies [9308aa4]
+    - @epicgames-ps/lib-pixelstreamingsignalling-ue5.7@0.3.0
+
 ## 2.3.0
 
 ### Minor Changes
 
 - 3bb3101: Updates to platform_scripts to fix argument passing to Wilbur.
-
     - Added separator between script parameters and signalling server parameters when using platform scripts
         - From now on, anything after the `--` marker on the command line is passed directly to Wilbur.
         - Parameters before this marker are intended for the scripts. These parameters are validated and unknown parameters will cause an error.
diff --git a/SignallingWebServer/package.json b/SignallingWebServer/package.json
index 827f3f39a..ad5b534e6 100644
--- a/SignallingWebServer/package.json
+++ b/SignallingWebServer/package.json
@@ -1,6 +1,6 @@
 {
     "name": "@epicgames-ps/wilbur",
-    "version": "3.0.1",
+    "version": "3.1.0",
     "description": "A basic signalling server application for Unreal Engine's Pixel Streaming applications.",
     "main": "dist/index.js",
     "private": true,