Skip to content

v0.1.2

Choose a tag to compare

View all tags
@FlyOverCoderKY FlyOverCoderKY released this 30 Jul 00:46
· 19 commits to main since this release
v0.1.2
This tag was signed with the committer’s verified signature.
FlyOverCoderKY Fly Over Coder
SSH Key Fingerprint: wJ89oEmkLnUBqbvNL7wjtuWnZpiO0E/a2FHUf3e/w8k
Verified
Learn about vigilant mode.
155dd5c
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security scan remediation (docs/securityscan.md, 2026-07-28 scan). No adapter behavior or public API change.

  • Publish pipeline: prepare pins the SHA-256 of the prepared package-manifest.json as a job output and publish verifies the downloaded manifest against it, so the file that authenticates every tarball hash is no longer checked only against itself.
  • Publish pipeline: the reviewed npm release is installed from a digest-pinned tarball (verified SHA-512) instead of a version resolved from the registry at run time.
  • Added .github/dependabot.yml for monthly npm and GitHub Actions updates.
  • Added SECURITY.md with the private vulnerability reporting channel, supported versions, and the adapters' documented non-guarantees.
  • Workflow property tests in tests/release-packages.test.ts cover both pipeline changes.
Assets 2
Loading