Skip to content

v0.1.0

Latest
Latest

Choose a tag to compare

View all tags
@patchprojectx patchprojectx released this 22 Oct 05:54
· 4 commits to main since this release
v0.1.0
7b1c479

First release of PATCH: exploited-vulnerability response, automated.

patchnow 0.1.0 (CLI, Node.js 20+, MIT, one runtime dependency)

  • Scans npm, pnpm, Yarn, Composer, requirements.txt, Poetry, Go and Cargo manifests plus Node.js / PHP / Go runtimes against OSV.dev, CISA KEV and FIRST EPSS.
  • patch.yml policy with triggers (KEV, severity, EPSS, ecosystem, package), dry run until armed: true, dedupe state and an append-only audit log (.patchnow/audit.jsonl).
  • Pre-approved actions: pin_patch (branch, commit, push, pull request), safe_mode (Render deploy hook, Vercel promote, signed webhook), revoke (GitHub token revocation API, npm token revoke; requires confirm: true), notify (webhook, Slack, Telegram, ntfy, email).
  • Text, JSON and SARIF output; --fail-on for CI gates.

GitHub Action: uses: patchprojectx/patch@v0.1 (composite, action.yml at the repository root). @v0.1 moves with v0.1.x; pin @v0.1.0 for this exact release.

Install (not published to npm):

npm install -g https://github.com/patchprojectx/patch/releases/download/v0.1.0/patchnow-0.1.0.tgz

SHA-256 of patchnow-0.1.0.tgz: 2f6c32753ad14f482fcb3f78fa3dac0a270e31a66ae2b29b3c14845ec73a1b5a

Tested in this release: 42 unit and end-to-end tests on Node 20, 22 and 24 (the e2e test runs the npm pin-patch loop against live OSV / KEV / EPSS with a local git remote and a mock GitHub API); the Action itself runs in dry-run mode in CI. pin_patch for pnpm, Go, Cargo and Composer is implemented but not yet end-to-end tested; safe_mode, revoke and notify are tested against local mock servers.

Website: https://patchproject.xyz

Assets 4
Loading