PKG-Defender v1.0.9

PKG-Defender v1.0.9

Released August 25, 2026

---

What's Changed

Fixed

• Homebrew tap update failed for v1.0.8 — an upstream Homebrew change (bae7b0408a,
  2026-07-28) made brew audit reject formulas whose explicit version stanza duplicates
  the version scanned from the download URL ("version 1.0.8 is redundant with version
  scanned from URL"). The tap formula no longer carries an explicit version stanza
  (Homebrew derives it from the release URL — the conventional shape for release-asset
  formulas); the release pipeline's version sed and its verification step were removed
  accordingly. URL and SHA256 substitution are unchanged.

Changed

• Refreshed the Homebrew formula description to match the current product tagline ("Stop
  supply chain attacks before they reach your machine").
• Corrected the Homebrew tap maintenance documentation (CONTRIBUTING.md): the
  pipeline authenticates via the PKG_DEFENDER_APP GitHub App (not a PAT), tap PR branches
  are formula/pkg-defender-*, the stale-PR-cleanup and auto-merge steps described there
  no longer exist (removed in 1.0.8), the no-version-stanza rationale is documented, and
  the sync-homebrew-tap.yml PR notes and .github/scripts/sync-brew-formula.py
  docstrings/help no longer claim version is preserved from tap state.

---

📖 5 Commits since v1.0.8

Commit	Description	Author
55095bc	docs(changelog): note sync prose corrections in 1.0.9	Division 7
67d0e40	docs(brew-tap): drop version from preserved-fields tap documentation	Division 7
29fd2d2	chore(docs): add contact info to readme, reinstate alt funding source	Division 7
6ab9398	chore(release): prepare v1.0.9	Division 7
0d26d0a	fix(release): drop formula version stanza injection to resolve brew audit redundancy	Division 7

---

View Complete Changelog →