Skip to content

v1.0.0-rc.3

Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 22 Jul 14:27
v1.0.0-rc.3
6692075

Universal Config Engine 1.0.0-rc.3

1.0.0-rc.3 is a security-only release candidate that replaces RC2 as the
reviewed source for stable 1.0.0.

Security

  • Pins the repository build and release lock's Ajv transitive fast-uri
    resolution to patched 3.1.4.
  • Clears GHSA-v2hh-gcrm-f6hx, a high-severity host-confusion advisory affecting
    the 3.1.3 resolution recorded in the RC2 dependency lock.
  • Restarts the stable 168-hour review window from this prerelease's GitHub Release
    publishedAt timestamp.

The published package manifests retain their existing Ajv compatibility ranges;
the workspace override makes source, CI, and release validation reproducible.
Fresh consumer installs resolve the patched transitive version. Consumers whose
own lockfile still records fast-uri<=3.1.3 must refresh it to a patched line.

Compatibility

RC3 does not change runtime source, public TypeScript declarations, package
READMEs, fixtures, smoke behavior, CLI contracts, diagnostic schema 0.2, or the
Node.js >=24 support range. The five package manifests advance together from
1.0.0-rc.2 to 1.0.0-rc.3.

Install

npm install @0disoft/universal-config-engine-core@1.0.0-rc.3
npm install @0disoft/universal-config-engine-node@1.0.0-rc.3
npm install --save-dev @0disoft/universal-config-engine-cli@1.0.0-rc.3

Optional validator integrations remain
@0disoft/universal-config-engine-validator-ajv and
@0disoft/universal-config-engine-validator-zod. Install every Universal Config
Engine package at the same RC3 version.

RC3 publishes under npm next; npm latest remains 0.6.0 throughout the new
review window.

Assets 9
Loading