Skip to content

v1.1.0

Choose a tag to compare

View all tags
@dkships dkships released this 11 May 00:22
v1.1.0
f374b83

First post-OSS-hardening release. Public API (MCP tools, resources, env vars) unchanged from 1.0.0; SemVer minor for the dropped Node 18 support and the new transparency of supply-chain hygiene.

Security

  • npm audit now reports zero vulnerabilities at any severity (prod + dev). The 5 dev-only moderate advisories in the previous esbuild/vite chain were resolved by the vitest 4 upgrade.
  • Patched 4 transitive runtime advisories via npm audit fix: fast-uri (HIGH path traversal + host confusion), hono (moderate bodyLimit/JSX/CSS/JWT/cache issues), ip-address (moderate XSS), express-rate-limit (moderate, inherited).
  • Bounded the 429 retry loop in HelpScoutClient.apiGet — 3-retry cap with exponential backoff and Retry-After honoured.
  • Fixed credit-card redaction regex in the PII scrubber. The previous pattern missed Amex's XXXX-XXXXXX-XXXXX shape; the new pattern matches any 13–19 digit run with separators, then defers to the Luhn check to filter false positives.
  • Added SECURITY.md with disclosure path and PII posture.

Dependencies

  • typescript 5 → 6
  • vitest 2 → 4
  • zod 3 → 4
  • @types/node 22 → 25
  • actions/checkout and actions/setup-node 4 → 6

Breaking

  • Dropped Node 18 support. Node 18 hit end-of-life April 2025; modern dev tooling (vitest 4, rolldown, esbuild) no longer runs on it. engines.node and the CI matrix now require Node 20+.

Build and tooling

  • Pinned tsconfig.json compilerOptions.types to ["node"] so TypeScript 6's implicit @types/* inclusion stays deterministic alongside vitest 4's new @types/chai/deep-eql/estree siblings.
  • New 21-test vitest suite covering SSN, CC (Luhn pass/fail), email, and phone redaction.
  • prepublishOnly gate runs build, tests, and npm audit --omit=dev --audit-level=high before publish.
  • Project hardening for OSS: files allowlist, bin entry (pm-copilot), CI matrix on Node 20 + 22, Dependabot config, issue/PR templates, CONTRIBUTING.md, CODE_OF_CONDUCT.md.

Genericization

  • Replaced client-identifying content (specific products, churn/scale figures, AppSumo-specific response filter) with generic illustrative examples so the public repo doesn't imply live customer data.

Full details in CHANGELOG.md.

Assets 2
Loading