Changelog

All notable changes to this project will be documented here

0.6.2 - 2026-08-03

Feat: add read-only token capability inference - (4b559f9)
Feat: add gated multi-ecosystem package tampering - (ecf7598)
Feat: add static package archive inspection - (3d6e390)
Test: add RED release-intel dependency report coverage - (7ceed1d)
Test: add RED coverage for cooldown CLI options - (1ede48a)
Test: add RED registry metadata coverage - (b51e9b0)
Feat: add dependency release age intelligence - (d7d7132)
Test: add RED coverage for dependency release intelligence - (e7f5820)
Test: add RED coverage for watch ref integration - (5f1a6db)
Test: add RED coverage for GitLab ref snapshots - (5ee8dc2)
Test: add RED coverage for release ref monitoring - (c422216)
Test: add RED coverage for release governance - (2a9c1c1)
Feat: add native SBOM and GitLab dependency reports - (8f6025d)
Test: add RED coverage for dependency report formats - (59926dc)
Test: add RED coverage for threat-feed IP and hash IOCs - (bc0d7ca)
Test: add RED coverage for archived SBOM discovery - (f81cf3f)
Test: add RED coverage for GitLab PAX archives - (b2e18f0)
Test: add RED coverage for mutable release refs - (2a2804b)
Test: add RED coverage for depx CLI and enumeration - (c8fe5fa)
Test: add RED coverage for native depx scanning - (1d6c6b7)

Feat: expose runner log sampling bounds - (308f30f)
Feat: expose project-aware token validation - (65b6a6d)
Feat: complete runner log fallback discovery - (356f866)
Feat: expose package artifact verification - (b7a3097)
Feat: verify package source and provenance - (1207d27)
Feat: expand package persistence detection - (d4c4df4)
Feat: expose dependency cooldown controls - (738e3aa)
Feat: monitor release refs and workflow changes - (717f32e)
Feat: collect GitLab ref snapshots safely - (8151774)
Feat: detect release ref lifecycle anomalies - (bd7f967)
Feat: audit publishing branch and tag governance - (9d04eb2)
Feat: flag mutable include release refs - (c66a6ca)
Feat: expose depx audits in CLI and enumeration - (f76af6b)
Feat: integrate native depx dependency auditing - (f1c3bea)

Docs: document runner and token reconnaissance - (ea243f8)
Docs: record package entry path hardening - (7a77950)
Docs: document gated package tamper testing - (e2e907b)
Docs: document static package artifact verification - (b9c1f09)
Docs: record final P0 depx validation - (be559d6)
Docs: document P0 release intelligence and monitoring - (b3efdd2)
Docs: record P0 depx TDD evidence - (4261ebe)
Docs: document native depx dependency auditing - (968a238)

Test: expose runner log sampling bounds - (f4fd9b8)
Test: expose project-aware token validation - (37d4cda)
Test: specify read-only token capability inference - (2c42b03)
Test: specify bounded runner log fallback - (b947552)
Test: reject package entry shell expansion - (d4d56e1)
Test: harden package tamper isolation and identity - (cd26224)
Test: define safe multi-ecosystem package tampering - (9938b32)
Test: exercise artifact verifier CLI end to end - (5fe69cc)
Test: distinguish release tags from bare branches - (f636c0f)
Test: harden artifact verifier boundaries - (062b375)
Test: define artifact verifier CLI and taxonomy - (ba36f72)
Test: define source and provenance verification - (abde8dd)
Test: define bounded package artifact inspection - (b410c60)
Test: define expanded package persistence detection - (e8352b3)
Test: cover depx bridge safety guards - (aa637f8)
Test: raise depx integration coverage above 80 percent - (51ac468)