Skip to content

v2.0.2 - Supply Chain Security Release

Latest
Latest

Choose a tag to compare

View all tags
@CseperkePapp CseperkePapp released this 26 Nov 06:22
· 110 commits to main since this release
v2.0.2
00284fe
This commit was signed with the committer’s verified signature.
claude Claude
SSH Key Fingerprint: 32dP45eSMmVSt/G/CGvcxl/P+MO3Nwj9xeTh/GSA2wc
Verified
Learn about vigilant mode.

v2.0.2 - Supply Chain Security Release

🚨 Security & CI Improvements

This release introduces major supply chain security hardening and CI/CD improvements.

🔒 Key Changes

  • SHA-pinned all GitHub Actions (5 actions) for reproducible CI/CD
  • Added --ignore-scripts to all npm ci commands to block malicious install scripts
  • Enabled npm provenance attestation for package authenticity
  • Automated Shai-Hulud IoC scanner runs before tests to detect indicators of compromise
  • Created SECURITY.md documentation (security policy, reporting, and best practices)
  • Updated README.md and CONTRIBUTING.md with new security and supply chain info

📝 Details

These changes significantly improve supply chain security, CI/CD integrity, and documentation for contributors and users. All workflows now use SHA-pinned actions and npm provenance. The new IoC scanner helps detect supply chain attacks before code is published or deployed.

📦 Installation

npm install design-constraint-validator@2.0.2

For full release history, see Releases.

🤖 Release notes generated with GitHub Copilot

Assets 4
Loading