Skip to content

v0.6.0

Choose a tag to compare

View all tags
@AmiteK23 AmiteK23 released this 20 Feb 18:48
· 107 commits to main since this release
v0.6.0
b86a145
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

This release focuses on runtime schema validation hardening, dependency security updates, fail-closed contract loading behavior, and improved cross-platform correctness. Contracts are now validated at load time and rejected when the schema is unavailable, ensuring deterministic architectural integrity.

⚠️ Breaking Changes

Node.js >= 20 Required

  • Minimum Node.js version bumped to >=20.
  • Required by dependency and security updates.
  • Users on Node.js < 20 must upgrade.

🔁 Changed

Dependency Updates

  • Upgraded ts-morph to 27.0.2 (from 21.0.1) with improved TypeScript 5.x support.
  • Updated glob to 13.0.6 to address a minimatch ReDoS vulnerability.

➕ Added

Runtime Schema Validation

  • .uif.json sidecar contract files are now validated via AJV at load time.
  • Invalid, malformed, or schema-drifted contracts are rejected.
  • Prevents corrupted architectural context from being consumed by tooling or AI agents.
  • Validation errors are capped at 20 entries for clarity.

🐞 Fixed

Fail-Closed Schema Behavior

  • Contracts are now rejected when the JSON schema cannot be loaded.
  • Prevents silent validation bypass.

Schema Validator Reliability

  • Ensures consistent valid / errors return values.
  • Correct err.data reporting.
  • Properly reports null and array instead of generic object.

Contract Loader Error Handling

  • Clearly distinguishes:
    • File not found
    • Read errors
    • JSON parse errors
    • Schema validation errors.
  • Improves debugging clarity.

File Lock Race Condition

  • Prevents concurrent processes from acquiring locks mid-write.
  • Improves cross-platform reliability.

🔐 Security

  • Enforces strict project-root boundaries across file loading utilities (path traversal protection).
  • Includes a fix for a minimatch ReDoS vulnerability via glob@13.0.6.

📚 Documentation

  • Updated SECURITY.md to document runtime schema validation and contract integrity guarantees.
  • Updated schema.md to reflect enforced validation behavior.

🧪 Tests

  • Added root-boundary traversal tests.
  • Expanded extraction and route coverage.
  • All tests passing.

🔗 Related PRs

  • #94 – File locking & traversal hardening
  • #95 – Extraction and test coverage expansion
  • #96 – Runtime schema validation
  • #97 – Dependency updates & fail-closed enforcement

👉 Full changelog

Assets 2
Loading