@blamejs/exceptd-skills 0.19.16 → 0.19.17

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (9) hide show
  1. package/CHANGELOG.md +10 -0
  2. package/data/_indexes/_meta.json +3 -3
  3. package/data/_indexes/activity-feed.json +1 -1
  4. package/data/_indexes/catalog-summaries.json +1 -1
  5. package/data/zeroday-lessons.json +1060 -42
  6. package/manifest.json +53 -53
  7. package/package.json +1 -1
  8. package/sbom.cdx.json +18 -18
  9. package/scripts/release.js +45 -10
package/CHANGELOG.md CHANGED
@@ -1,5 +1,15 @@
1
1
  # Changelog
2
2
 
3
+ ## 0.19.17 — 2026-08-11
4
+
5
+ Another 41 CVEs report the controls they require, taking coverage to 793 of 1025. The set includes Chromium V8, Apple WebKit and CoreMedia, PAN-OS, MOVEit Transfer, SharePoint, Cisco ASA and Catalyst SD-WAN, Ivanti's Cloud Services Appliance, D-Link NAS devices, jQuery, and GNU Bash.
6
+
7
+ Where the vulnerable code is a file rather than a package, the scan's silence is not a finding of absence. jQuery ships inside applications — vendored into a web root, emitted by a build step, embedded in a third-party product's web interface — and the affected range covers effectively every copy ever placed that way, so an inventory keyed to installed packages has no row to report on. The entry also names the second measurement that reads clean: the vulnerability's own text says the untrusted HTML executes even after sanitizing it, so an application recording sanitization as its mitigation has recorded something the defect is documented to survive.
8
+
9
+ Some entries have no fixed build to reach. The D-Link NAS devices are past end of support with the vendor's confirmation on record, no patch, and no live-patch path — so removal is the requirement rather than a step after patching, and restricting reachability is the only lever an operator holds for as long as a unit stays in service. On appliances holding the primary and backup copy of a site's files, that distinction is the whole disposition.
10
+
11
+ A CVE's identifier year is not its remediation priority. The Bash entry carries a 2014 identifier and a 2025 listing date, so a process that ages work by identifier files it as historical while the clock is running — the requirement is that the listing, not the year, sets the queue position. It also separates a family-level attestation from this member: an estate that closed its Shellshock work on "newer than the first fix" has not shown the build carrying the fix for this defect, and the population that needs it is the hosts where attacker-controlled data actually reaches a Bash environment rather than every host with Bash installed.
12
+
3
13
  ## 0.19.16 — 2026-08-10
4
14
 
5
15
  Another 39 CVEs report the controls they require, taking coverage to 752 of 1025. The set includes React Native's development server, React Server Components, F5 BIG-IP, Fortinet SSL-VPN, Ivanti Connect Secure, PAN-OS, SonicWall, SAP NetWeaver, Oracle E-Business Suite, ImageMagick, and the Windows CLFS and CNG entries.
package/data/_indexes/_meta.json CHANGED
@@ -1,10 +1,10 @@
1
1
  {
2
2
  "schema_version": "1.1.0",
3
- "generated_at": "2026-08-11T06:34:54.393Z",
3
+ "generated_at": "2026-08-11T09:01:39.003Z",
4
4
  "generator": "scripts/build-indexes.js",
5
5
  "source_count": 64,
6
6
  "source_hashes": {
7
- "manifest.json": "c9388c82ab6cfe10577db246ab26ee8f2185abaa4bd134c00d8f261b2d02f2e2",
7
+ "manifest.json": "f1d6c26db0c69d4cfe6b5102ea2ea2f9e98326d46643247374297dec8ed18de4",
8
8
  "README.md": "0fa9b167172f104810e5ee6040f11ed741217f7a51c2552a15c69d2a15a164aa",
9
9
  "data/atlas-ttps.json": "a14089671efcb4f06dd0f82d688fe49276c1370e167e4483d76e9c0a40ef41eb",
10
10
  "data/attack-techniques.json": "6bc0619bcccceccc8d5c12aefa6c11197c625e5d7313e70474f2831e271b23f0",
@@ -16,7 +16,7 @@
16
16
  "data/framework-control-gaps.json": "a0a43cd0c8fff6ca753bb2c98f121922ff3de63102b7d67c86c76037e28cd553",
17
17
  "data/global-frameworks.json": "20b18a851b3ab82e57cd159b49476d69fe544f02523398b2015189ab81c7c3f8",
18
18
  "data/rfc-references.json": "6e9017eca910ab7e4bee85ad7c23927fd6ec766f34be7fce49ebf020cec3381a",
19
- "data/zeroday-lessons.json": "9bb88ec789870a08a83fb28e5a24fbfa9453146d2de2c9b54bd2ecb92af6a79b",
19
+ "data/zeroday-lessons.json": "d7c74ff511efedae14f975b1af26fc31d725d00b1657245a8625868df13ee344",
20
20
  "skills/kernel-lpe-triage/skill.md": "0f79c641cef6e5f4a942eb94f43c460562bf83dfb67ae112d146c39c6b320fb0",
21
21
  "skills/ai-attack-surface/skill.md": "c97335e14cd34bd1cd3c9d2cbd397f33569a07292b2f2f7721483575eb4459f7",
22
22
  "skills/mcp-agent-trust/skill.md": "6195c93a6cadb213051214742890fa2bf4e39bae377a654d4195f0c90bd8b896",
package/data/_indexes/activity-feed.json CHANGED
@@ -6,7 +6,7 @@
6
6
  },
7
7
  "events": [
8
8
  {
9
- "date": "2026-08-10",
9
+ "date": "2026-08-11",
10
10
  "type": "catalog_update",
11
11
  "artifact": "data/zeroday-lessons.json",
12
12
  "path": "data/zeroday-lessons.json",
package/data/_indexes/catalog-summaries.json CHANGED
@@ -229,7 +229,7 @@
229
229
  "path": "data/zeroday-lessons.json",
230
230
  "purpose": "Distilled lessons from notable zero-days and campaigns (SesameOp, Copy Fail, Dirty Frag, Copilot RCE, Windsurf MCP). Each entry: technique, distinguishing characteristic, what it means for the framework lag.",
231
231
  "schema_version": "1.1.0",
232
- "last_updated": "2026-08-10",
232
+ "last_updated": "2026-08-11",
233
233
  "tlp": "CLEAR",
234
234
  "source_confidence_default": "B2",
235
235
  "freshness_policy": {