Skip to content

OpenLore 3.0.0

Choose a tag to compare

View all tags
@clay-good clay-good released this 24 Aug 02:10
v3.0.0
79d6bf2
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

OpenLore 3.0.0 is the release where trust becomes part of the architecture.

This major release makes OpenLore more honest about what it analyzed, more careful with repositories it does not trust, and much harder to misconfigure at the boundaries between local code, agent tooling, and release infrastructure.

Highlights

  • Secure by default. Repository-controlled symlinks can no longer redirect OpenLore writes outside their intended targets. Local daemon traffic is token-protected by default, legacy daemons are negotiated safely, and installed Git hooks pin a trusted OpenLore launcher instead of executing mutable project binaries.
  • Secrets stay out of model context. Committed repository configuration can no longer resurrect ignored secret files or disable tool-output redaction. Explicit operator controls remain available when that behavior is intentional.
  • More honest analysis and drift results. Analysis reports whether it came from cache, drift reports carry coverage receipts, and unavailable checks no longer masquerade as clean results.
  • Stronger governance. Enforcement schema v3 normalizes severity names and adds frozen-baseline ratchet evidence. Decision-gate grace periods are bound to the exact staged source snapshot.
  • A release pipeline that proves what it ships. CI now tests the exact Node.js floor, deterministic integration paths, Windows packaging, dependency audit behavior, package contents, and the immutable artifact promoted to npm. Nix packaging is synchronized with the release.

Breaking changes

OpenLore 3.0.0 intentionally tightens several public contracts:

  • Analysis results now require fromCache; depGraph is optional when no trustworthy persisted graph exists.
  • Generation and full-run results are discriminated by dryRun. Narrow on result.dryRun before reading pipelineResult, init, or analysis.
  • GenerationReport.configSchemaVersion is required. openloreVersion now consistently means the OpenLore package version.
  • Drift JSON requires analyzedFiles and filesOmitted. Exit code 1 means confirmed drift; exit code 2 means the check could not run.
  • Enforcement JSON is schema version 3. Severity warn is now warning.
  • The minimum supported Node.js version is 22.19.0.

Upgrade

npm install --global openlore@3.0.0

If you embed OpenLore as a library, update result narrowing and report types before deploying. If you use installed Git hooks or the local daemon, reinstall/restart them after upgrading so they receive the v3 launcher and protocol protections.

Full changelog: v2.2.0...v3.0.0

Assets 2
Loading