@blamejs/exceptd-skills 0.19.4 → 0.19.6

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 0.19.6 — 2026-08-08
+
+Another 48 CVEs report the controls they require, taking the catalog to 358 of 1025. The set spans SharePoint and SolarWinds Web Help Desk deserialization, Samsung MagicINFO and SimpleHelp path traversal, Fortinet FortiClient EMS, Ivanti Endpoint Manager, CRI-O and containerd, and the Apple and Chromium memory-safety entries.
+
+Three requirements recur because the vulnerabilities keep demonstrating them. Where a vendor fix exists but needs a service restart the frameworks let operators defer, the remediation clock has to budget the restart rather than count the installer run as done. Where exploitation writes something that outlives the fix — an uploaded web shell, a resident implant — patching closes the entry point without evicting what came through it, so a process whose terminal state is "patched" leaves the foothold in place. And where a product is commissioned once and left outside the fleet patch cadence, a signage server or a remote-support server, the listing date is the only thing that pulls it back into scope.
+
+Entries name the framework controls they close and carry a test that separates the control being present from it being effective. Where no control in the inventory fits a CVE without a category error, the entry stays empty rather than taking a near-match.
+
+## 0.19.5 — 2026-08-08
+
+Three CVEs reported a control with no name and no requirement text. Their catalog entries held a bare string where the schema expects a control record, which was invisible until 0.19.4 began displaying the field and then rendered as `- undefined undefined:` in the gap report. All three describe the remediation clock for a KEV-listed flaw and now say so, closing the vulnerability-management gaps that already cite them. A malformed record is now omitted from the report rather than printed, so this class degrades to silence instead of noise, and the catalog test fails on the shape so it cannot recur unseen. Three further controls declared no framework gap at all and now name the ones they close.
+
+Eight more CVEs report the controls they require, among them CitrixBleed, the Fortinet SSL-VPN out-of-bounds write, the ConnectWise ScreenConnect traversal and the Cisco Secure Firewall Management Center deserialization. These concentrate on what a perimeter appliance compromise demands beyond patching — treating a device that ran a vulnerable build during confirmed exploitation as compromised rather than fixed, and keeping request-level logs outside the appliance's own trust zone long enough to investigate a listing that arrives years after disclosure. Each names the framework controls it closes and carries a test that separates the control being present from it being effective.
+
 ## 0.19.4 — 2026-08-08
 
 `framework-gap` now reports the controls a CVE needs that no framework carries yet. The command already answered half the question — which existing controls are insufficient — and stopped there, so an operator learned which controls fall short without learning what belongs in their place. The catalog had recorded the answer for 302 CVEs since the zero-day learning loop began and no command read it, in either output mode. Each entry names the requirement, its evidence, and the specific framework controls it closes, so it attaches to the gaps listed above it rather than reading as free-standing advice. Both the human-readable report and `--json` carry it, and the summary line counts it.

package/data/_indexes/_meta.json

@@ -1,10 +1,10 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-08-08T22:55:59.109Z",
+  "generated_at": "2026-08-09T06:35:58.928Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 64,
   "source_hashes": {
-    "manifest.json": "4f92a89e4b15843aed7516645c38e3eaec48993fe3043f74b98e97a42f2d38b4",
+    "manifest.json": "aebdb8f8ea8f29fab794c12a13005fe2bca2d0185f2ca7c2217c9c813d27a059",
     "README.md": "0fa9b167172f104810e5ee6040f11ed741217f7a51c2552a15c69d2a15a164aa",
     "data/atlas-ttps.json": "a14089671efcb4f06dd0f82d688fe49276c1370e167e4483d76e9c0a40ef41eb",
     "data/attack-techniques.json": "6bc0619bcccceccc8d5c12aefa6c11197c625e5d7313e70474f2831e271b23f0",
@@ -16,7 +16,7 @@
     "data/framework-control-gaps.json": "a0a43cd0c8fff6ca753bb2c98f121922ff3de63102b7d67c86c76037e28cd553",
     "data/global-frameworks.json": "20b18a851b3ab82e57cd159b49476d69fe544f02523398b2015189ab81c7c3f8",
     "data/rfc-references.json": "6e9017eca910ab7e4bee85ad7c23927fd6ec766f34be7fce49ebf020cec3381a",
-    "data/zeroday-lessons.json": "9bc4f85c15d1618ef438a9221346c6913f823c5b8368acc2b2d5756c3a07c21e",
+    "data/zeroday-lessons.json": "aa12abe32c909f97d66be9f9a1be220e4dfd0fccf291eb59ef8ba185c03fa489",
     "skills/kernel-lpe-triage/skill.md": "0f79c641cef6e5f4a942eb94f43c460562bf83dfb67ae112d146c39c6b320fb0",
     "skills/ai-attack-surface/skill.md": "c97335e14cd34bd1cd3c9d2cbd397f33569a07292b2f2f7721483575eb4459f7",
     "skills/mcp-agent-trust/skill.md": "6195c93a6cadb213051214742890fa2bf4e39bae377a654d4195f0c90bd8b896",