Skip to content

v0.34.0

Choose a tag to compare

View all tags
@Helweg Helweg released this 02 Oct 09:53
· 68 commits to main since this release
Immutable release. Only release title and notes can be modified.
v0.34.0
c4e7b4a
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Highlights

  • Selective automatic-exclusion opt-in: indexing.includeExcluded indexes and watches selected source paths that automatic defaults block — build-named, vendor, hidden, and minified/bundled paths — while explicit exclude patterns, Git-only includeIgnored, and index-storage protections stay authoritative. This replaces the unpublished build-only excludeBuildPaths option (#378).
  • Dependency security: The runtime advisory pins were raised to their patched releases — brace-expansion 5.0.12, fast-uri 3.1.8, hono 4.13.7, ip-address 10.7.1 — closing Dependabot findings #68–#71. The previous pins sat below every fix version, which kept the resolved tree vulnerable and left the Dependabot updater unable to propose a fix (#380).
  • Logging: The customProvider.baseUrl API-version warning no longer interpolates parsed configuration values, so it cannot echo credentials embedded in a URL, and CodeQL alert #25 is fixed (#380).
  • Watcher and configuration refresh: Wildcard opt-ins keep matching ancestor directories traversable (build-*/src/*.ts, .g*/scripts/*.ts), and the nearest TypeScript/JavaScript configuration with safe local extends dependencies is watched on both watcher backends.

The full change history since published v0.33.0 is in CHANGELOG.md.

Release checks

  • Reconciled against all 15 commits since v0.33.0; the stale empty v0.33.1 draft was deleted.
  • Changelog, npm version and Claude/Codex plugin manifests updated to 0.34.0; SECURITY.md supported line moved to 0.34.x.
  • Node 22 and 24 CI, path-semantics on macOS/Ubuntu/Windows, and CodeQL passed on the release commit c4e7b4a.
  • Trusted publish workflow passed: package-metadata, six native build targets (macOS x64/arm64, Linux x64/arm64, Windows x64/arm64) and publish, all on c4e7b4a.
  • Both package identities are published at 0.34.0 with signed provenance and are the npm latest version. Registry propagation lagged roughly five minutes per package before the new versions were visible; no publish errors were reported.
  • Clean-install smoke tests passed for both identities: npm audit --omit=dev reports zero vulnerabilities; ESM import and CJS require both load; all four binary names resolve (open-codebase-index-mcp, opencode-codebase-index-mcp, cbi, ocbi); MCP initialize succeeds and tools/list returns 19 tools; native binaries ship for all five supported platforms.

Known non-blockers

  • The dev-only brace-expansion@5.0.9 copy inside @earendil-works/pi-coding-agent's published shrinkwrap remains; root overrides cannot reach a shrinkwrapped subtree (#379).
  • @opencode-ai/plugin 1.18.x is deliberately not adopted: it raises the runtime floor to Node ^22.22.2 || ^24.15.0 || >=26.0.0 and ships effect@4.0.0-beta (#392).
Assets 3
Loading