Skip to content

shellsentry v0.1.3

Choose a tag to compare

View all tags
@github-actions github-actions released this 11 Mar 11:48
v0.1.3
48b7c3e

Release Notes

v0.1.3

Highlights

  • Security dependency sweep: all known stdlib and x/crypto CVEs resolved.
  • Go toolchain bumped to 1.26.1; shell parser (mvdan.cc/sh) updated to v3.13.0.
  • Goneat dependency protection added with vulnerability gating at high severity.
  • Agentic attribution hardened against email squatting with full provenance chain format.

Changed

  • Go toolchain: 1.25.1 -> 1.26.1 (resolves 1 critical, 10 high, 11 medium stdlib CVEs).
  • mvdan.cc/sh/v3: 3.12.0 -> 3.13.0 (shell parser, direct dependency).
  • golang.org/x/crypto: 0.31.0 -> 0.48.0 (resolves 3 advisories).
  • golang.org/x/sys: 0.33.0 -> 0.42.0.
  • github.com/spf13/pflag: 1.0.9 -> 1.0.10.
  • Pinned tool minimums: sfetch v0.4.5, goneat v0.5.7.
  • Commit attribution now requires model vendor URL, tool URL, Role trailer, and full Committer-of-Record identity.
  • Role catalog reorganized into categorized tables.

Added

  • .goneat/dependencies.yaml with vulnerability scanning, license compliance, and package cooling policy.

Security

  • Zero vulnerability findings after upgrades (was 1 critical, 10 high, 11 medium).
  • Vulnerability gating enforced at high severity via goneat dependency protection.
Assets 17
Loading