Skip to content
This repository was archived by the owner on Sep 6, 2026. It is now read-only.

v0.6.0

Choose a tag to compare

View all tags
@askalf askalf released this 04 Sep 00:53
· 5 commits to main since this release
v0.6.0
2a74cd3
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Ships the 0.5.1→0.6.0 window (31 commits). Full detail in CHANGELOG.md.

Highlights:

  • fieldpass scan <url> works with no CDP browser configured (#77). Every URL
    used to route through the CDP path, so npx -y @askalf/fieldpass scan https://…
    threw a puppeteer assert stack unless a browser was already running. A URL
    without a browser is now fetched and parsed statically, labelled
    captured: static, with capturedBy in --json and exit 65 on fetch failure.
  • Two false-positive classes fixed (#78): invisible-only nodes, and the unanchored
    agent: / model: role label that quarantined RFC 9110. Hostile fixtures
    unchanged.
  • ClusterFuzzLite over the injection trust boundary (#64).
  • node-html-parser to ^9, and qs overridden to ^6.16.0 — a runtime path via
    @modelcontextprotocol/sdk → express → qs, closing GHSA-4mjr-xmp4-gh2g and
    GHSA-x5fp-wj9c-mxmx.
Assets 4
Loading