v0.5.2

v0.5.2 release evidence

Scope, audit, harden, and retest web projects with AI coding agents and reproducible evidence.

Web App Security Skill v0.5.2 is a focused correctness patch over v0.5.1. It repairs report
rendering, pnpm workspace lockfile evidence, nested JavaScript/TypeScript template coverage and
path-only retest evasion without expanding the stable rule boundary or changing evidence states.

Release identity

• Version/tag: v0.5.2
• Source identity: the commit peeled from the SSH-signed annotated tag; the exact commit is recorded
  in web-app-security-skill-0.5.2.release.json and the provenance attestation.
• Runtime matrix: Node.js 22 and 24 on Ubuntu and macOS; Bash 3.2 remains covered on macOS.
• Stable corpus: 20 built-in risk rules, two evidence-integrity rules and eight opt-in external
  adapter rules, unchanged from v0.5.1.

This file is part of the source commit it describes and therefore does not embed a fabricated
self-referential source SHA. The signed tag, manifest and provenance establish the published source
identity.

Correctness fixes

Structured risk summaries

The v3 Markdown and HTML renderers now read each state's structured { total, bySeverity } value.
They omit zero-count states and render both state totals and nonzero severity counts. The report's
first risk summary no longer coerces those objects to [object Object].

pnpm workspace lockfiles

The missing-lockfile rule now reads bounded pnpm-workspace.yaml package patterns and recognizes an
applicable ancestor pnpm-lock.yaml. Positive and negative package patterns form an include/exclude
boundary. Unreadable, oversized or unsupported workspace metadata makes the
check incomplete and emits evidence-integrity coverage; it does not produce a confirmed absence.

This parser supports the ordinary string-list form and JSON-compatible inline arrays. It is not a
general YAML implementation. A package excluded from the workspace still needs its own applicable
lockfile.

Nested template coverage

The bounded JavaScript/TypeScript tokenizer now tracks nested template literals and their
expression depth, including templates inside TSX brace expressions. Template text remains ignored
as data while code inside ${...} remains tokenized and scanned. An unterminated template still
produces partial coverage and explicit unknown evidence.

Rename-aware retesting

Retesting now derives a path-independent movement fingerprint from rule identity, adapter identity
and normalized evidence. A unique one-to-one match across old and new paths is reported as
unchanged with reason condition_moved. Duplicate or otherwise ambiguous matches remain separate
new and fixed observations so the comparison does not guess.

Compatibility and security boundary

• Finding/report v3, persisted-subject comparison and v2 migration semantics remain compatible.
• Syntax and external scanner matches remain suspected until independent evidence confirms them.
• Missing or failed source evidence remains unknown; no parser fix turns unavailable evidence into
  a pass.
• Passive network defaults, authorization acknowledgements and review-only repair behavior are
  unchanged.
• This release is not general SAST/DAST coverage, authenticated testing or proof that a project is
  secure.

Release verification

The release workflow runs npm run check, rebuilds all four release assets twice and compares every
byte, verifies archive structure, checksums, manifest and SPDX SBOM, exercises isolated install and
upgrade, then requests GitHub build provenance before publication.

Verify the signed tag:

git -c gpg.ssh.allowedSignersFile=.github/release-signers verify-tag v0.5.2

After publication, verify SHA256SUMS, compare the manifest source commit with
git rev-parse 'v0.5.2^{}', verify provenance, and only then add the immutable asset digests to the
verified installer. The mutable v1 alias moves only after the public consumer workflow passes.