0.9.0

What's Changed

🛡️ Security

The npm audit report against brace-expansion is closed. The patched releases are now held by overrides: in package.json, not only by what package-lock.json pins, so the floor survives every later resolution here and in each repository cloned from this one.

Resolved copy	Before	After
brace-expansion on the 1 line	1.1.18	1.1.21
brace-expansion on the 5 line	5.0.9	5.0.12

🤖 Skills

Area	What changed
npm run hora:init	Runs scripts/hora-init.sh, which equips @openreachtech/hora, then every @openreachtech/hora-skills-* it finds under node_modules/, then every @openreachtech/hora-addon-* in two passes (skills, then wings). Packages are found by name, so a package added to devDependencies is equipped by the next npm install
npm install in a directory named hora-boilerplate	Equips nothing. postinstall still runs, and scripts/hora-init.sh says it skipped
/hora-setup	Fetches a row's tagged tree instead of cloning it, and stages the initial commit by name. Copying skills into a row is gone
/hora-setup	Asks whether the project is public when a fetched CLAUDE.md carries a rule meant only for a public repository, and records the answer in .hora/tree/<repository>.md
/hora-setup	Writes an ## Environment section into .hora/tree/<repository>.md, copied from the origin document
/hora-setup	Routes every stop-and-ask through asking.md, so an active add-on may take the decision
docs/stack/origins/furo.md, docs/stack/origins/renchan.md	Say how a client reaches the backend, which env files each side commits, what the environment needs, and name the tagged tree as the source

🛡️ Supply Chain

.npmrc now sets strict-allow-scripts = true. An install stops, rather than warns, when a dependency has an install script that allowScripts in package.json does not cover.

📦️ Dependencies

devDependencies:

package name	old version	new version	semver	note
@openreachtech/hora	^0.9.0	^0.16.0	Minor	Pre-1.0, so a minor can break. scripts/hora-init.sh equips from this range
@openreachtech/hora-skills-ort-core	^0.4.0	^0.6.0	Minor
@openreachtech/hora-skills-ort-furo	^0.3.0	^0.5.0	Minor
@openreachtech/hora-skills-ort-renchan	^0.2.1	^0.3.0	Minor
@openreachtech/hora-skills-ort-support	^0.4.0	^0.7.0	Minor

overrides:

Both entries are new in this version. old version is what the tree resolved to before them.

package name	old version	new version	semver	note
brace-expansion@1	1.1.18	^1.1.21	Patch	Closes the npm audit report. Carried by minimatch@3.1.5. Scoped to its major line so the override stays inside the range minimatch declares
brace-expansion@5	5.0.9	^5.0.12	Patch	Closes the npm audit report. Carried by @typescript-eslint/typescript-estree

Change Log

Full Changelog: 0.8.0...0.9.0