0.10.0

What's Changed

🛡️ Security

• npm audit reports no vulnerability for this version

🤖 Skills

Area	What changed
/hora-setup	Step 7 switches the database when the spec's manual-verification table names one other than MariaDB: it installs the driver, points sequelize/config.cjs at the dialect, replaces the CI database service and rewrites docker-compose.development.yml. A database the table does not list is a stop-and-ask
docs/stack/origins/renchan.md	Lists the dialect, driver packages, CI image, port and health check for MariaDB, MySQL and PostgreSQL. development stays on SQLite, and the page says how a project moves it to a server database
docs/stack/middleware.md	Says its database values are MariaDB's, and points at the switch

📦️ Dependencies

devDependencies:

package name	old version	new version	semver	note
@openreachtech/hora-skills-ort-core	^0.6.0	^0.7.0	Minor	Pre-1.0, so the caret stopped below this minor
@openreachtech/hora-skills-ort-furo	^0.5.0	^0.8.0	Minor	Adds /hof-oidc-sign-in
@openreachtech/hora-skills-ort-renchan	^0.3.0	^0.5.0	Minor	Adds /hor-oidc-sign-in and covers PostgreSQL in the database skills

Change Log

Full Changelog: 0.9.0...0.10.0

0.9.0

What's Changed

🛡️ Security

The npm audit report against brace-expansion is closed. The patched releases are now held by overrides: in package.json, not only by what package-lock.json pins, so the floor survives every later resolution here and in each repository cloned from this one.

Resolved copy	Before	After
brace-expansion on the 1 line	1.1.18	1.1.21
brace-expansion on the 5 line	5.0.9	5.0.12

🤖 Skills

Area	What changed
npm run hora:init	Runs scripts/hora-init.sh, which equips @openreachtech/hora, then every @openreachtech/hora-skills-* it finds under node_modules/, then every @openreachtech/hora-addon-* in two passes (skills, then wings). Packages are found by name, so a package added to devDependencies is equipped by the next npm install
npm install in a directory named hora-boilerplate	Equips nothing. postinstall still runs, and scripts/hora-init.sh says it skipped
/hora-setup	Fetches a row's tagged tree instead of cloning it, and stages the initial commit by name. Copying skills into a row is gone
/hora-setup	Asks whether the project is public when a fetched CLAUDE.md carries a rule meant only for a public repository, and records the answer in .hora/tree/<repository>.md
/hora-setup	Writes an ## Environment section into .hora/tree/<repository>.md, copied from the origin document
/hora-setup	Routes every stop-and-ask through asking.md, so an active add-on may take the decision
docs/stack/origins/furo.md, docs/stack/origins/renchan.md	Say how a client reaches the backend, which env files each side commits, what the environment needs, and name the tagged tree as the source

🛡️ Supply Chain

.npmrc now sets strict-allow-scripts = true. An install stops, rather than warns, when a dependency has an install script that allowScripts in package.json does not cover.

📦️ Dependencies

devDependencies:

package name	old version	new version	semver	note
@openreachtech/hora	^0.9.0	^0.16.0	Minor	Pre-1.0, so a minor can break. scripts/hora-init.sh equips from this range
@openreachtech/hora-skills-ort-core	^0.4.0	^0.6.0	Minor
@openreachtech/hora-skills-ort-furo	^0.3.0	^0.5.0	Minor
@openreachtech/hora-skills-ort-renchan	^0.2.1	^0.3.0	Minor
@openreachtech/hora-skills-ort-support	^0.4.0	^0.7.0	Minor

overrides:

Both entries are new in this version. old version is what the tree resolved to before them.

package name	old version	new version	semver	note
brace-expansion@1	1.1.18	^1.1.21	Patch	Closes the npm audit report. Carried by minimatch@3.1.5. Scoped to its major line so the override stays inside the range minimatch declares
brace-expansion@5	5.0.9	^5.0.12	Patch	Closes the npm audit report. Carried by @typescript-eslint/typescript-estree

Change Log

Full Changelog: 0.8.0...0.9.0

0.8.0

What's Changed

📦️ Dependencies

devDependencies:

package name	old version	new version	semver	note
@openreachtech/hora	^0.8.0	^0.9.0	Minor	A caret range below 1.0.0 does not reach the next minor, so a clone made from this version gets 0.9.0 and one from 0.7.0 stays on 0.8.x

Change Log

Full Changelog: 0.7.0...0.8.0

0.7.0

What's Changed

🛡️ Security

Nothing is outstanding against this version. js-yaml was raised from 4.3.1 to 4.3.2 in package-lock.json, closing GHSA-2883-xcg3-v3hh. It arrives through eslint and @eslint/eslintrc, so no package.json field names it and the lockfile is the only place the raise shows.

🐛 Bug Fixes

docs/stack/origins/renchan.md and docs/stack/origins/furo.md stated that renchan-boilerplate and furo-boilerplate-nuxt were private, and had a session wait for someone to clone them beforehand. Both repositories are public, so /hora fetches them itself and a non-interactive run no longer needs those directories prepared by hand.

📄 Documentation

README.md and README.ja.md now say that this template builds a web application, and send a native Android or iOS project to hora-boilerplate-mobile instead, which runs the same method over Kotlin and Swift rows.

📦️ Dependencies

postinstall runs hora:init, which installs these into the repository. Raising them changes the /hora skill and the skill libraries a project is built with.

devDependencies:

package name	old version	new version	semver	note
@openreachtech/hora	^0.7.0	^0.8.0	Minor
@openreachtech/hora-skills-ort-core	^0.2.0	^0.4.0	Minor
@openreachtech/hora-skills-ort-furo	^0.1.0	^0.3.0	Minor
@openreachtech/hora-skills-ort-renchan	^0.1.0	^0.2.1	Minor
@openreachtech/hora-skills-ort-support	^0.2.0	^0.4.0	Minor

Change Log

Full Changelog: 0.6.0...0.7.0

0.6.0

What's Changed

• 📄 Add quick start

Change Log

Full Changelog: 0.5.0...0.6.0

0.5.0

What's Changed

• Release 0.5.0 > Main by @StewEucen in #147

Full Changelog: 0.4.0...0.5.0

0.4.0

What's Changed

• 📦️ Bump dependency skills package version to latest by @StewEucen in #142
• 📄 Bump boilerplate version to 0.4.0 by @StewEucen in #144
• Release 0.4.0 > Main by @StewEucen in #145

Full Changelog: 0.3.0...0.4.0

0.3.0

What's Changed

• 🦵 Kick out min-release-age-exclude from .npmrc by @StewEucen in #134
• ⚙️ Add boilerplate-version.yml GitHub workflows by @StewEucen in #136
• 📄 Update boilerplate version to 0.3.0 by @StewEucen in #139
• Release 0.3.0 > Main by @StewEucen in #137

Full Changelog: 0.2.0...0.3.0

0.2.0

What's Changed

• 📦️ Update hora packages to latest (0.4.0) by @StewEucen in #75
• 🧵 Update the ignore rules for the three skills packages by @hieuguyen-ort in #79
• 📦️ Use the three hora-skills-ort-* packages instead of hora-skills by @hieuguyen-ort in #77
• 📄 Update the skills document for the three packages by @hieuguyen-ort in #81
• 📄 Update the architecture document for the three packages by @hieuguyen-ort in #83
• 📄 Update the README files for the three packages by @hieuguyen-ort in #85
• 📄 Update the remaining documents for the three packages by @hieuguyen-ort in #87
• 📄 Update the layer diagram for the three packages by @hieuguyen-ort in #89
• 🔗 Use the source URL for every kit reference by @hieuguyen-ort in #91
• 📄 Fix the claims in Getting started that stopped being true by @hieuguyen-ort in #93
• 📄 Update the package count the documents state by @hieuguyen-ort in #98
• 📄 Rename /bank-id to /hor-bank-id in docs/ by @hieuguyen-ort in #99
• 🚚 Take /hora-setup into this repository by @hieuguyen-ort in #101
• 📄 Say this repository authors /hora-setup by @hieuguyen-ort in #103
• 📄 Correct the layer diagram headline by @hieuguyen-ort in #105
• 📄 Bump boilerplate version to 0.2.0 by @StewEucen in #95
• 🧵 Ignore the support skills record by @hieuguyen-ort in #114
• 📄 Name the support package in docs/skills* by @hieuguyen-ort in #115
• 📄 Name the support package in docs/architecture* by @hieuguyen-ort in #116
• 📄 Name the support package in the README files by @hieuguyen-ort in #117
• 📄 Name the support package in the remaining documents by @hieuguyen-ort in #118
• 📄 Draw the support package in the layer diagrams by @hieuguyen-ort in #119
• 📦️ Install the support skills package by @hieuguyen-ort in #120
• 📄 Kick out the writing style documents by @hieuguyen-ort in #122
• 📄 Kick out the command reference by @hieuguyen-ort in #124
• 📄 Retake the architecture document by @hieuguyen-ort in #126
• 📄 Kick out the adopting guide by @hieuguyen-ort in #128
• 📦️ Update dependency package version to latest by @StewEucen in #130
• Release 0.2.0 > Main by @StewEucen in #131

Full Changelog: 0.1.0...0.2.0

0.1.0

What's Changed

• Add the stack handbook: the boilerplate's own stack, documented for the kit to read by @JYama321 in #70
• 📄 Update boilerplate version to 0.1.0 by @StewEucen in #71
• Release 0.1.0 > Main by @StewEucen in #72

Full Changelog: 0.0.0...0.1.0