Skip to content

v0.1.1

Choose a tag to compare

View all tags
@FlyOverCoderKY FlyOverCoderKY released this 30 Jul 00:36
· 16 commits to main since this release
v0.1.1
This tag was signed with the committer’s verified signature.
FlyOverCoderKY Fly Over Coder
SSH Key Fingerprint: wJ89oEmkLnUBqbvNL7wjtuWnZpiO0E/a2FHUf3e/w8k
Verified
Learn about vigilant mode.
b724fb9
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security patch release resolving the open findings from the 2026-07-29 security scan.

Anchored the prepared release manifest across the publish job boundary. package-manifest.json previously travelled to the publish job inside the same artifact as the tarballs it describes, so a self-consistent replacement of both would have satisfied every internal check. The prepare job now records the manifest SHA-256 as a job output — crossing the boundary through run metadata rather than the artifact — and release:publish requires that digest and compares it with timingSafeEqual before the manifest is parsed. The gate is fail-closed: a missing or malformed digest aborts the publish.

Gated CI on shipped-dependency advisories. CI now runs npm audit --omit=dev --audit-level=low, so runtime dependencies are enforced clean (currently 0 advisories) and any future advisory in a shipped dependency fails the build. The remaining advisories are confined to the dev-only Azurite test chain, which has no upstream fix available, and stay tracked and non-gating.

No public API changes — @pegma/storage-blobs, @pegma/storage-azure-blob, @pegma/storage-cloudflare-r2, and @pegma/storage-s3 all move 0.1.0 → 0.1.1.

Assets 2
Loading