v1.0.0-rc.3

Universal Config Engine 1.0.0-rc.3

1.0.0-rc.3 is a security-only release candidate that replaces RC2 as the
reviewed source for stable 1.0.0.

Security

• Pins the repository build and release lock's Ajv transitive fast-uri
  resolution to patched 3.1.4.
• Clears GHSA-v2hh-gcrm-f6hx, a high-severity host-confusion advisory affecting
  the 3.1.3 resolution recorded in the RC2 dependency lock.
• Restarts the stable 168-hour review window from this prerelease's GitHub Release
  publishedAt timestamp.

The published package manifests retain their existing Ajv compatibility ranges;
the workspace override makes source, CI, and release validation reproducible.
Fresh consumer installs resolve the patched transitive version. Consumers whose
own lockfile still records fast-uri<=3.1.3 must refresh it to a patched line.

Compatibility

RC3 does not change runtime source, public TypeScript declarations, package
READMEs, fixtures, smoke behavior, CLI contracts, diagnostic schema 0.2, or the
Node.js >=24 support range. The five package manifests advance together from
1.0.0-rc.2 to 1.0.0-rc.3.

Install

npm install @0disoft/universal-config-engine-core@1.0.0-rc.3
npm install @0disoft/universal-config-engine-node@1.0.0-rc.3
npm install --save-dev @0disoft/universal-config-engine-cli@1.0.0-rc.3

Optional validator integrations remain
@0disoft/universal-config-engine-validator-ajv and
@0disoft/universal-config-engine-validator-zod. Install every Universal Config
Engine package at the same RC3 version.

RC3 publishes under npm next; npm latest remains 0.6.0 throughout the new
review window.

v1.0.0-rc.2

Universal Config Engine 1.0.0-rc.2

This candidate keeps the RC1 runtime and public API while hardening the package and
stable release surfaces before 1.0.0.

Package Documentation

Every published package now carries its own npm README with package-specific
installation, minimum usage, runtime requirements, contract boundaries, and links
to maintained documentation. Packed-package smoke fails if any README is absent or
does not identify its package and repository.

Stable Release Safety

Stable publication now fails closed unless release-policy.json authorizes the
version and its reviewed candidate has:

• completed the declared minimum review duration;
• a published GitHub prerelease with all five tarballs;
• complete package-level publication evidence;
• npm integrity and SLSA provenance;
• correct next and latest dist-tags;
• a successful exact-version registry installation smoke.

Packed Type Migration Guard

Strict TypeScript consumers now compile the packed core declaration and prove that
the supported ValidatorIssue fields remain available while category, message,
sourceId, and details remain outside the public type. This catches drift between
source-level type tests and the declaration shipped to npm.

Migration

The only intentional breaking API change remains the RC1 removal of ignored legacy
ValidatorIssue fields. See the 1.0 migration guide.

Install this candidate by exact version or npm next; npm latest remains on the
previous stable release.

v1.0.0-rc.1

Release v1.0.0-rc.1 publishes Universal Config Engine packages from the validated tag.

v0.6.0

Release v0.6.0 publishes Universal Config Engine packages from the validated tag.

v0.5.0

Release v0.5.0 publishes Universal Config Engine packages from the validated tag.

v0.4.0

Release v0.4.0 publishes Universal Config Engine packages from the validated tag.

v0.3.1

Release v0.3.1 publishes Universal Config Engine packages from the validated tag.

v0.3.0

Release v0.3.0 publishes Universal Config Engine packages from the validated tag.

v0.2.1

Release v0.2.1 publishes Universal Config Engine packages from the validated tag.

v0.2.0

Release v0.2.0 publishes Universal Config Engine packages from the validated tag.