v0.29.0

0.29.0 (2026-11-03)

Features

• app: the course's lessons as pages of the site (#591) (a5e94ea)

Bug Fixes

• install: keep package-lock.json in step with the devDependencies merge, and ship only the suite's (#594) (33f378a)
• security: re-scan main for CVEs weekly, not only on a push (#593) (934b3d9)

v0.28.0

0.28.0 (2026-10-31)

Features

• app: a Learn page for the course, and no sideways scroll on narrow phones (#586) (b7f6051), closes #585
• install: install-skill.sh refreshes the skills from the pinned CLI (#575) (995aaa0), closes #571

Bug Fixes

• ci: keep the Playwright cache on a red run, bound the apt phase and skip it on hosted runners (#582) (dff126e)
• licences: a stdlib-only project passes, and a tooling error is not posted as a licence failure (#584) (0f2a955)

v0.27.0

0.27.0 (2026-10-31)

Features

• install: slopstopper install writes the suite from the files the CLI ships (#569) (d22d002)

Bug Fixes

• install: the shipped-checks guard reads the CLI's listing without a pipe (#568) (7766b1c)

v0.26.0

0.26.0 (2026-10-25)

Features

• demo: one deliberate finding per lesson in the fixture repo (#553) (9474fc1)
• security: licence inventory over the full resolved dependency tree (#551) (516ef14)
• serve: apply the file headers.source names, so a local run sends the host's policy (#559) (ca27ae7)

Bug Fixes

• learn: a fails block names the exit it promises, and a release refreshes lesson samples (#561) (7322bf1)
• privacy: judge visible text and real dates, exit 2 on a bad headers source, find router pages (#563) (f1316ba)
• privacy: skip hidden directories when discovering the page and the host config (#552) (c91f279)

v0.25.0

0.25.0 (2026-10-25)

Features

• ci: one ss-playwright composite action with a per-version browser cache (#541) (cb718ab)
• hygiene: privacy statement check for sites on hosts that keep traffic data (#543) (a55f92e)
• site: privacy page and footer note for slopstopper.dev (#539) (f20bd89), closes #533
• site: Workers Logs off and Giscus loads on click (#540) (f9e923c)
• skills: adopter feedback loop: repo topic, label, upstream issues, workaround markers (#534) (d1020e1)

Bug Fixes

• ci: run Playwright's apt phase outside the timed retry loop (#532) (c2df019)
• dast: probe the target's port, not :8080, before a localhost scan (#544) (3b0e646)
• install: warn when the pinned CLI lacks a check the shipped shims call (#546) (2cc9b15)

v0.24.0

0.24.0 (2026-10-24)

Features

• cli: slopstopper demo writes a small repo two checks fail on (#516) (085be0c)

v0.23.0

0.23.0 (2026-10-24)

Features

• security: a seeded licence allowlist for dependency review (#482) (7a14ece), closes #481
• sitemap: llms_ignore_paths leaves a section out of the llms.txt diff only (#522) (12f4853), closes #456

Bug Fixes

• cloudflare: read the preview URL from the bot's Markdown table too (#523) (ca3dc46), closes #459
• what installing on apic surfaced (nested wrangler, SEO env var, licence ids, workflow hardening, ignore_refs) (#478) (7e3debc)

v0.22.0

0.22.0 (2026-10-12)

Features

• docs: generate the check tables and the README badges from the registry (#475) (453c36e), closes #469

v0.21.0

0.21.0 (2026-10-12)

Features

• site: draw the hero's terminal demo as animated SVG from real CLI output (#474) (74c1baa), closes #466
• VHS demos, colour-safe output, a CLI surface test and --json on reporting commands (#472) (c6341b3)

Bug Fixes

• dast: hand ZAP only the plugin-id rows of .zap/rules.tsv (#463) (e6039e6), closes #454
• dast: report a crashed ZAP scan with its cause and fail the scan step (#464) (fd71f3d), closes #455
• install: leave an already-configured public/_headers alone on refresh (#462) (f579d90), closes #453
• profiles: keep workflow names that already have an extension under workflows.disabled (#461) (99a29b4), closes #452

v0.20.5

0.20.5 (2026-10-11)

Bug Fixes

• deploy: skip stale Cloudflare deploys and branches with no PR (#457) (a11f3fd)