v1.1.0

Two new P2 testing rules, README translations in nine languages and how-to GIFs.

Added

• Terminal GIFs in docs/assets/ for installing a preset, the installer's conflict protection, building a preset and the contributor checks, rendered from real command output and shown in the README.
• README translations in docs/i18n/ for Simplified Chinese, Hindi, Spanish, Arabic, French, Bengali, Brazilian Portuguese, Russian and Urdu, with a language switcher in every version; English stays the default README.md.
• rules/testing/pytest.md (P2): pytest 9 native TOML config and strict mode, fixtures and scopes, keyword-only parametrize options, pytest-asyncio 1.x without the event_loop fixture, boundary-only mocking, no network in unit tests, coverage for changed code, and CVE-2025-71176 (fixed in 9.0.3).
• rules/testing/a11y.md (P2): WCAG 2.2 AA target, semantic HTML before ARIA, names, keyboard and focus handling, axe-core checks in Playwright, Cypress and component tests, a11y lint plugins, manual keyboard and screen-reader passes, and no overlay widgets.
• pytest to security/watchlist.yml.

Changed

• Add testing/a11y to the react-vite, next-supabase and nest-angular presets; python-fastapi no longer warns about the missing testing/pytest rule.
• Exclude ftc.gov from the lychee link check because it answers automated requests with an error.
• Rewrite README.md with an at-a-glance summary, "Why version-aware rules", "How it works", a tool table, a supported-stacks list and an FAQ; the generated catalog and preset tables are unchanged.
• Point the README Quick start, in every language, at the v1.1.0 tag.

Fixed

• Markdownlint errors in frontend/forms-validation, languages/csharp and the migrate-angularjs skill.
• Replace the removed OWASP Go cheat sheet link in backend/go-http with the OWASP Go Secure Coding Practices guide.
• Exclude npmjs.com, which blocks CI runners, from the lychee link check.
• Remove .gitkeep files from folders that now have content.

Security

• frontend/react-vite-spa: add CVE-2026-118662 (server.fs.deny bypass, a regression in Vite 6.4.4) and raise the 6.x minimum safe version to 6.4.5.
• frontend/nuxt, legacy/vue2-nuxt2 and upgrade-nuxt: add CVE-2026-119200 (path dot segments bypass server/middleware and route rules in Nuxt 4.6.0–4.6.2) and raise the minimum safe version to 4.6.3.
• security/watchlist.yml: record both advisories and the new safe versions.

v1.0.0

First release: every P0 and P1 rule from the roadmap, the P2 stacks, two legacy packs, 32 skills, presets, evals and the security automation.

Added

• MIT LICENSE, NOTICE.md with Project CodeGuard (CC BY 4.0) attribution, SECURITY.md and CONTRIBUTING.md.
• .github/CODEOWNERS with placeholder owners and stricter entries for security-sensitive paths.
• .github/PULL_REQUEST_TEMPLATE.md with sources, version range, lint/build and eval checklist.
• docs/decisions.md recording decisions D1–D8.
• conventions/phaedra.md house-style overlay.
• Folder skeleton for rules/, skills/, presets/, security/, templates/ci/, evals/ and scripts/.
• ROADMAP.md and implementation-prompts/.
• .gitignore for dist/ and node_modules/.
• rules/core/behavior.md: always-on working rules (scoped changes, small steps, existing patterns, one-line security findings, rule and version disclosure).
• rules/core/security-baseline.md: always-on secure coding rules grouped by OWASP Top 10:2025 with 2025 CWE Top 25 IDs, partly adapted from Project CodeGuard.
• README.md catalog table.
• rules/core/supply-chain.md: always-on dependency, lockfile, release-age cooldown (npm, pnpm, Yarn, Bun, uv), install-script, CI hardening, publishing, SBOM and suspected-compromise rules.
• rules/core/agent-safety.md: always-on rules for prompt injection, secrets, risky commands, tool config files, MCP servers and keeping the coding tool updated (2026 Cursor advisories).
• rules/core/legacy-mode.md: on-demand rules for working on versions below a rule's range or past end of life.
• skills/security-audit: detect the stack, run the audit toolbox, triage by severity, reachability, CISA KEV and EPSS, and write security-report.md; includes scripts/detect-stack.sh.
• skills/dependency-vet: pre-install checks (existence, typosquats, malware, age, maintainers, downloads, scripts, license, provenance) with registry queries for npm, PyPI, crates.io, Packagist, RubyGems, NuGet, Maven Central and pub.dev.
• skills/cve-check: package@version lookups through OSV, the GitHub Advisory Database, vendor pages, CISA KEV and EPSS.
• skills/secrets-scan: gitleaks scans of staged changes, the working tree, ranges and history, with revoke-first rotation and consent-only history rewrites.
• skills/threat-model-lite: 10-minute STRIDE pass producing abuse cases, controls mapped to OWASP Top 10:2025, and tests.
• skills/incident-supply-chain: response steps for compromised dependencies, including token-monitor wipers, persistence hunting, rotation order, reporting and a timeline; indicators from Shai-Hulud through Miasma.
• skills/git-commit: the team's dash-list commit flow with approval and a staged-files secret scan.
• scripts/lint-rules.mjs (Node ≥ 22, no dependencies): validates rule, convention and skill frontmatter, required headings, size, alwaysApply scope and cross-references; scans every tracked text file for hidden Unicode; --network checks packages in install commands; --json output.
• scripts/lint-rules.test.mjs with fixtures in scripts/fixtures/.
• .github/workflows/lint.yml: lint script, its tests, markdownlint and lychee, with SHA-pinned actions and read-only permissions.
• .markdownlint.jsonc and lychee.toml.
• .DS_Store in .gitignore.
• security/watchlist.yml: 25 packages from ROADMAP §5.8 with documented safe versions, cited advisories and rule IDs, re-verified against OSV and GHSA.
• scripts/check-advisories.mjs: OSV batch check of the watchlist with CISA KEV flags; --create-issues (de-duplicated), --dry-run, --json, --min-severity.
• scripts/check-freshness.mjs: compares applies_to with npm, PyPI, Maven Central, NuGet, Packagist and endoflife.date, and flags reviews older than 90 days.
• scripts/lib/automation.mjs and scripts/automation.test.mjs (mocked fetch and gh).
• Workflows: advisories.yml (daily), freshness.yml (weekly), monthly-review.yml (monthly checklist issue).
• templates/ci/github/security.yml: OSV-Scanner (official reusable workflows), Semgrep CE, gitleaks (checksum-verified binary), zizmor and opt-in Trivy, with per-job permissions and SARIF upload.
• templates/ci/github/dependabot.yml: npm, pip, composer, gomod and GitHub Actions with a 7-day cooldown.
• templates/ci/gitlab/security.gitlab-ci.yml: OSV-Scanner, Semgrep CE and gitleaks with digest-pinned images.
• templates/package-managers/: .npmrc, pnpm-workspace.yaml, .yarnrc.yml, bunfig.toml and uv.toml with release-age cooldowns and install-script policy.
• templates/ci/README.md: setup, pin updates, false-positive tuning and mapping to rules and skills.
• scripts/build.mjs: builds Cursor .mdc rules, AGENTS.md, generated <category>-<name>-conventions skills, CLAUDE.md and skill copies into dist/, with a sha256 manifest; --preset selects a preset.
• scripts/install.mjs: builds a preset and copies it into a project for cursor, agents and claude, with --dry-run, conflict protection, --force and a version file.
• Presets: next-supabase, nest-angular, rn-expo, react-vite, python-fastapi, laravel, ai-app, all-core.
• scripts/build.test.mjs with fixtures; the lint workflow now builds and runs these tests.
• rules/languages/typescript.md: strictness, boundary validation with Standard Schema, ESM config, and TypeScript 7 native-compiler compatibility (hard errors, no programmatic API until 7.1).
• rules/frontend/react.md: React 19.3 components, hooks, React Compiler memoization, security and testing; RSC advisories with minimum safe 19.2.8.
• rules/frontend/react-vite-spa.md: Vite 8 (Rolldown/Oxc) config renames, public VITE_* env, dev-server exposure, React Router 8, TanStack Query; Vite and React Router advisories.
• conventions/phaedra.md: React section with the house component layout, API module, toast error handling and Tailwind theme colors.
• react-router in security/watchlist.yml.
• Project CodeGuard evaluation and OWASP 2025 gap analysis under D2 in docs/decisions.md; adapted-file list in NOTICE.md.
• rules/frontend/nextjs.md: Next.js 16 App Router conventions, Cache Components, Server Action and Route Handler checks with a Zod example, proxy.ts limits, next/image and CSP settings; advisories with minimum safe 16.4.1.
• rules/legacy/nextjs-pages-router.md: Pages Router and Next.js 12–15 rules for getServerSideProps, API routes and middleware (CVE-2025-29927, i18n data-route bypass), support status (15.x Maintenance LTS through 2027-01-31, 14.x unsupported), and the App Router migration path.
• skills/upgrade-nextjs: one-major-at-a-time upgrades with the official codemods, a React and Node compatibility table, 14 → 15 and 15 → 16 follow-ups (proxy.ts, async request APIs, ESLint CLI, images config), and build, test and smoke-test checks.
• rules/frontend/angular.md: Angular 20–22 conventions (standalone, inject(), signals, zoneless, OnPush by default, built-in control flow, @defer, Signal Forms, httpResource, @angular/aria, Vitest), a core/, shared/, features/ layout, and security for sanitizer bypasses, Trusted Types, CSP, XSRF and SSR allowedHosts; 2026 advisories with minimum safe 22.2.1, 21.2.25 and 20.3.34.
• rules/legacy/angular-ngmodules.md: NgModule apps and Angular 2–19, adapted from angular-rules.md, with the layered architecture, version-gated APIs, safe-maintenance rules, EOL dates per major, unfixed 2026 CVEs with compensating controls, and the standalone → control flow → signals → zoneless migration path.
• skills/upgrade-angular: one-major-at-a-time ng update with the update guide, per-hop checks through v22 (Eager change detection, paramsInheritanceStrategy, Fetch backend, trustProxyHeaders), the standalone, control-flow, inject() and signal migrations, zoneless adoption checks, the Karma → Vitest switch, and build, test, e2e and smoke-test checks.
• rules/mobile/react-native-expo.md: React Native 0.82+ / Expo SDK 55+ (current RN 0.88, SDK 58) on the New Architecture, with app/ for routes and _layout files only, screens in src/features/<screen>/, the single apis object with a matching definition and call, config plugins for native changes, keyboard handling, and security for EXPO_PUBLIC_* secrets, expo-secure-store, deep and universal links (+native-intent), WebView, EAS Update code signing and Metro4Shell, with MASVS pointers.
• rules/legacy/react-native-old-arch.md: React Native below 0.82, Expo SDK 54 or older and bare React Native CLI apps, with architecture detection on both platforms, native-module compatibility checks, unsupported-version status, the Metro4Shell exposure of old CLI versions, and the path through RN 0.81 / SDK 54 to the New Architecture.
• skills/upgrade-react-native: one Expo SDK (or one RN minor for bare apps) at a time with npx expo install --fix and the Upgrade Helper, per-library New Architecture readiness checks, expo prebuild --clean caveats, and release builds on iOS and Android plus an EAS build smoke test.
• rules/backend/nestjs.md: NestJS 12 module layout, controllers and services with shared method names, Standard Schema or class-validator validation (and what each pipe skips), a global auth guard with @Public(), response serializers, 12.1 built-in CSRF, security headers and cookies, throttling, body limits, config validated at boot, ESM path aliases, and 2026 Fastify and microservice advisories with minimum safe 12.0.3.
• rules/backend/nestjs-microservices.md: per-transport TLS and authentication table (TCP is plaintext), typed ClientProxy wrappers with timeouts, payload validation with RpcException, a provider-neutral RealtimePublisher for real-time updates, and BullMQ processors that throw so retries work.
• rules/backend/nestjs-data.md: Sequelize, TypeORM and Prisma 7 variants of injection and managed transactions, allow-listed query helpers, parameteriz...