v1.0.15

CI consolidation: pre-merge checks now run as a single backgrounded gate job on one runner (same wall-clock via parallel background steps, one npm ci, fewer runners). No action behavior or dist changes. Also switches the enforce-node22 dogfooding gate to dependency-policy: compatible (floor structurally failed on transitive devDeps declaring engines.node >=16/18).

v1.0.14

Fix setup-node node-version-file path normalization.

• Normalize setup-node node-version-file paths before ignore matching so equivalent in-repo paths like ./generated/.nvmrc, ././generated/.nvmrc, and generated/../generated/.nvmrc are scanned correctly.
• Reject node-version-file references that resolve outside the repository root instead of silently skipping standard files.
• Avoid unsafe suggested commands for outside-root references; summaries now instruct users to move the version file into the repository.

v1.0.13

Scope Yarn dependency-metadata remediation commands to the directory containing the reported yarn.lock.

v1.0.12

Validate setup-node node-version-file references to standard Node version files even when those files live under ignored generated paths such as dist/.

v1.0.11

Fail closed for standalone .tool-versions files without a nodejs entry and reject unparsable Volta Node pins even when floating declarations are allowed.

v1.0.10

Fix the suggested remediation command for .tool-versions setup-node references so it appends a nodejs entry instead of writing a bare version.

v1.0.9

Fail closed on empty or malformed .tool-versions Node declarations, including setup-node node-version-file references that lack a nodejs entry.

v1.0.8

Fail closed on empty Node version files, extend allow-floating to .tool-versions, and make the required workflow prepare Yarn dependency metadata before running the Node policy action.

v1.0.7

Fix allow-floating so the documented opt-in applies consistently to Node version files and actions/setup-node declarations, including matrix-expanded setup-node values. The default strict behavior remains unchanged.

v1.0.6

Tightens final enforcement behavior: required workflow/default dependency policy now uses floor mode, registry-qualified Docker Hub Node images are scanned, and malformed installed dependency manifests fail closed. Includes updated docs, regenerated bundles, and regression coverage.