Release v0.5.6

What's Changed

Commits since v0.5.5

• chore: update CHANGELOG for v0.5.6 (re-release) (16ce928)
• fix: SVG info transform arithmetic calculation (5d852a9)
• fix: tree-viz JSON escaping and duplicate echo bugs (19a4b98)
• fix: tree visualization - CodeQL schedule, SVG rendering, relative paths (4a39c17)
• feat: add fractal git tree visualization (create-tree.sh) (4131135)
• feat: add security branch cleanup and --auto-sign flag (b2a96a6)
• chore: update CHANGELOG for v0.5.6 (re-release) (41403dd)
• refactor: replace ludeeus/action-shellcheck with native shellcheck (223da66)
• chore: update CHANGELOG for v0.5.6 (ce6a753)
• refactor: replace peter-evans/create-pull-request with gh CLI (82693e5)
• security: fix untrusted-checkout vulnerabilities in automerge workflow (c8470aa)
• fix: restore correct variables in PR body template (eb4f8e2)
• fix: remove self-referential env vars and use correct shell syntax (837d676)
• fix: disable autofix automatic trigger to prevent infinite loop (0a630d1)
• fix: autofix script should skip env: sections and revert broken changes (687ab3e)
• Merge pull request #91 from XAOSTECH:security/autofix-1771727196 (2aa1820)
• security: auto-fix CodeQL alerts (7f1f4ac)
• fix: break up ${{ in env var echo to prevent parser interpretation (0f4ab1e)
• fix: prevent parser from interpreting bash array syntax as expression (42df46b)
• fix: workflow validation errors (e67d419)
• fix: prevent duplicate env sections and inline security script (38cc5ed)
• feat: amend security review issues instead of creating duplicates (5b3c9f5)
• Merge branch 'main' of https://github.com/XAOSTECH/dev-control (ed42e70)
• fix: prevent duplicate security review issues and fix inverted logic (317ff94)
• Merge pull request #75 from XAOSTECH:security/autofix-1771725722 (297282e)
• Merge pull request #77 from XAOSTECH:security/autofix-1771725763 (7ba15e3)
• security: auto-fix CodeQL alerts (9c9aedd)
• security: auto-fix CodeQL alerts (9007125)
• Merge pull request #71 from XAOSTECH:security/autofix-1771725675 (a285150)
• security: auto-fix CodeQL alerts (4ed930b)
• Merge branch 'main' of https://github.com/XAOSTECH/dev-control (3ac9cac)
• security: replace insecure regex with explicit bot allowlist + label requirement (95eed72)
• feat: add automerge label to security-fix PRs (2287308)
• Merge pull request #45 from XAOSTECH/security/autofix-1771725086 (56d40f9)
• security: auto-fix CodeQL alerts (7e35584)
• fix: trim spaces from expression capture and handle git diff errors (e379ba9)
• fix: security-autofix script input handling and consistency (725cf89)
• fix: add env section before run when extracting vulnerable expressions (7dab5c8)
• chore: make security-autofix script executable (4655db8)
• refactor: move complex script to external file to avoid expression parsing issues (956083a)
• fix: remove expression syntax from comment (f83a370)
• fix: remove ellipsis from JSON comment to avoid expression parser error (8b7c5a2)
• chore: whitespace - trigger workflow reload (a54ad83)
• fix: use head/tail instead of awk to avoid GitHub Actions expression parsing (04b1c29)
• refactor: replace Python with robust shell script for code-injection fixes (e85e41e)
• refactor: use Python for robust code-injection vulnerability fixing (b57d892)
• fix: skip PR creation when no files modified (759666f)
• fix: prevent jq backtick parsing in issue body (12eca20)
• Merge pull request #37 from XAOSTECH:security/autofix-1771640641 (f66fa45)
• fix: ensure labels exist before PR creation (b96d279)
• security: auto-fix CodeQL alerts (96e2dd8)
• fix: send commit payload via gh api input (f4e8ac2)
• fix: send git tree payload via gh api input (bd68599)
• fix: allow workflow_dispatch to bypass workflow_run guard (c057d55)
• debug: add tree JSON inspection output (81a2623)
• fix: build tree JSON properly with jq instead of string concat (8369a4f)
• fix: send parents as JSON array in commit API call (41142d0)
• sync: update security-autofix template with API approach (c33c2d7)
• fix: use GitHub API instead of git push for workflow changes (2a518f8)
• debug: test API write permission (25f2815)
• fix: use create-github-app-token@v2 with all required permissions (34e46dd)
• debug: add token permission check (0a0afb7)
• sync: update security-autofix template with permission grants (64a73b6)
• fix: add explicit permission grants for GitHub App token (30e3798)
• fix: remove duplicate env block in bash-lint-advanced.yml (c002d10)
• fix: remove redundant git config - identity action handles this (1320a58)
• fix: use relative path for local identity action (d6f3a86)
• fix: remove invalid expression syntax from comment (6e31c5b)
• fix: eliminate ALL multiline strings from workflow YAML (1a45db8)
• fix: remove heredoc syntax from workflows - use temp files (8aa9e5b)
• fix: use heredoc syntax for multiline strings in workflows (b1b0f77)
• chore: sync security-autofix template with fixed workflow (5e218cc)
• fix: remove broken Python code from security-autofix workflow (9e34978)
• security: fix code injection in central-loader variables (5688f94)
• security: implement workflow_run pattern for automerge (a8650b2)

Installation

Full Toolkit (tarball)

curl -fsSL https://github.com/XAOSTECH/dev-control/releases/download/v0.5.6/dev-control-0.5.6.tar.gz | tar xz
cd dev-control-0.5.6
./install.sh

Library Only (lightweight)

For projects that only need the TUI/print/colour utilities (~27KB vs ~180KB):

curl -fsSL https://github.com/XAOSTECH/dev-control/releases/download/v0.5.6/dev-control-lib-0.5.6.tar.gz | tar xz

# Then in your scripts:
source "./dev-control-lib-0.5.6/colours.sh"
source "./dev-control-lib-0.5.6/print.sh"
print_header "My Script"

Homebrew (coming soon)

brew tap xaoscience/tap
brew install dev-control

Checksums

File	SHA256
dev-control-0.5.6.tar.gz	0163604ad7aba519c994f3f054f7c9c3f67645706484da57efdfc3447e7d8e7f
dev-control-lib-0.5.6.tar.gz	e9e7a5a13950be7d2ba1a2d13970c5c2d95c9fc5931a487c3b5a638c2b28b442

---

Full Changelog: v0.5.5...v0.5.6