ForgeKit v0.5.1

ForgeKit v0.5.1

Security Fixes

• Fix 4 TOCTOU file system race conditions (CWE-367) in plugin-manager, publish, env, and docs-cmd
• Validate JSON payloads before sending to external AI APIs (CWE-200) in OpenAI and Anthropic providers
• Replace existsSync check-then-write patterns with atomic accessSync or exclusive wx flag

Improvements

• Fix release announcement workflow OAuth (proper requests-oauthlib signing)
• Tweet template now extracts feature bullets from release notes
• Auto-trim tweets to 280 character limit
• Add workflow_dispatch trigger for manual release announcements
• Add npm package README with logo, architecture diagram, and full documentation
• Expand npm squatting watchlist to 41 monitored package names
• Add changelog page to docs site
• Add post-publish CI workflow to auto-update docs with new version

Stats

• 6 CodeQL alerts resolved (0 remaining)
• 429/429 tests passing
• 18 test suites