Skip to content

LLLL Guard 0.3.0: requires Node.js 22.12 or newer

Latest
Latest

Choose a tag to compare

View all tags
@JettyMarquis JettyMarquis released this 04 Oct 17:43
· 7 commits to main since this release
Immutable release. Only release title and notes can be modified.
v0.3.0
4dc59f7
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

LLLL Guard 0.3.0: requires Node.js 22.12 or newer

Breaking for some users: the minimum Node.js version is now 22.12. Node 20 reached end of life in April 2026, and commander 15 (the command-line library the package ships with) needs 22.12 or newer. If you are on Node 20, stay on 0.2.x or upgrade Node first. 0.2.x will not receive further fixes.

node --version                      # must be v22.12.0 or newer
npm install -g @layrix.ai/llll-guard@latest
llll-guard --version                # 0.3.0

What changed since 0.2.0

The package

  • engines is >=22.12.0. The guard launcher checks major and minor (22.0 to 22.11 are refused) and says "Node.js 22.12 or newer was not found" when it finds none; in a git hook that is the same warn-first behaviour as before (LLLL_GUARD_STRICT=1 stops the push).
  • commander 13 to 15 and minimatch 10.2.5 to 10.2.6. No behaviour of the command line changes: the options and exit codes (0 passed, 1 blocked, 2 could not run) are the same, and the whole test suite (712 tests, run against the real CLI and real git) passes on Node 22 and 24, Linux and macOS.
  • Development: vitest 5. CI now runs on Node 22 and 24.

The skill and the documents (the clone, not the npm package)

  • SKILL.md is split: a 912-line core and five reference files it tells the model to read on demand (scan, guard and review modes, menus, output standards, observation storage). Same content; about half of what every /llll call loads.
  • A pass over examples, sample audits and the checklist corrected factual errors and unsupported statements (for example the affected versions of CVE-2025-29927, poetry audit, sk- versus Stripe key formats). Statements that depend on how a law applies are waiting for expert review.
  • SECURITY.md (private vulnerability reporting is on), CONTRIBUTING.md, issue and pull request templates, Dependabot updates.
  • The fork monitor no longer fails the run or mentions a takedown when someone forks the repository; the licence is MIT.

Upgrading a project that has the hook installed

Nothing to reinstall. The hook runs the launcher, which finds a suitable Node. If your shell's default is Node 20, install Node 22.12 or newer (or set LLLL_NODE to one) before pushing; otherwise the hook warns that the push was not checked.

Known gaps

Legal and regulatory wording in the examples is awaiting expert review. Failing closed (stopping a push when Node or the engine is missing) becomes the default in 1.0.

Assets 3
Loading