v2.23.5

What's new

Security hygiene and documentation completeness — a defense-in-depth fix for a long-standing static analysis warning, companion documentation for the May sprint arc, and a set of plan records updated to reflect what actually shipped.

Bug Fixes

A CodeQL js/incomplete-multi-character-sanitization alert (#31) on docs/scripts/transform-content.ts had been stable in the weekly maintenance report for over five weeks. The cleanDescription helper was using a single-pass replace(/<[^>]+>/g, '') strip — the textbook shape the analyzer flags, because adversarial input like <<tag> survives one pass with the leading < intact.

The trust boundary here is real: this helper only runs against committed SKILL.md and agent frontmatter description fields, never against runtime user input. The fix iterates the strip to a fixed point so any residue from the first pass is caught on the next, and a comment above the loop documents the constraint explicitly for future contributors who might reach for the helper in a higher-trust context. No build output changed; docs:build still emits the same 110 pages.

Documentation

Two documentation efforts closed out the May 22–23 sprint arc:

Plan status reconciliation (#438): Three plan docs from the sprint were still marked status: active despite all their work shipping in merged PRs. The fix sets each to status: completed with a shipped: block carrying the PR number, release tag, and date. The CI automation plan doc also enumerates the four hotfix PRs (#431–#434) that followed the initial merge, giving future readers a complete picture of the delivery sequence.

Solutions compound (#437): Two solution docs were refreshed with verified-in-production content from the five-PR chain (PRs #430–#434) that landed end-to-end CI release-notes-narrative automation. Key updates include:

• The architecture doc's trigger-chain block now reflects the final scripts/dispatch-release-notes.sh + timestamp-based identification design, replacing the original inline successCmd + log-scan approach.
• The "Correlation-token-based polling" decision was replaced with "Timestamp-based polling with correlation as audit anchor," documenting the v2.23.3 production failure (Fro Bot bootstrap time exceeding the 90s log-scan budget) and the v2.23.4 fix (DISPATCH_EPOCH + gh run list createdAt filtering).
• A new "Production Verification" section captures the four-failure-mode table and the structural lesson: mock-based integration tests cannot model real-world Lodash rendering, GitHub API contract validation, or agent runtime characteristics.
• The semantic-release-body-ingestion-myth doc was updated with a pointer to the v2 CI architecture and a clarification that the underlying myth remains true.

Also in this release

• build(dev): Update OpenCode through v1.15.6 → v1.15.7 → v1.15.8 → v1.15.10 (#436, #439, #441, #442)
• build(dev): Pin @semantic-release/exec to 7.1.0 (#435)
• deps: Update all non-major dependencies (#440)

Compare

v2.23.4...v2.23.5