@blamejs/exceptd-skills 0.19.5 → 0.19.6

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.19.6 — 2026-08-08
+
+Another 48 CVEs report the controls they require, taking the catalog to 358 of 1025. The set spans SharePoint and SolarWinds Web Help Desk deserialization, Samsung MagicINFO and SimpleHelp path traversal, Fortinet FortiClient EMS, Ivanti Endpoint Manager, CRI-O and containerd, and the Apple and Chromium memory-safety entries.
+
+Three requirements recur because the vulnerabilities keep demonstrating them. Where a vendor fix exists but needs a service restart the frameworks let operators defer, the remediation clock has to budget the restart rather than count the installer run as done. Where exploitation writes something that outlives the fix — an uploaded web shell, a resident implant — patching closes the entry point without evicting what came through it, so a process whose terminal state is "patched" leaves the foothold in place. And where a product is commissioned once and left outside the fleet patch cadence, a signage server or a remote-support server, the listing date is the only thing that pulls it back into scope.
+
+Entries name the framework controls they close and carry a test that separates the control being present from it being effective. Where no control in the inventory fits a CVE without a category error, the entry stays empty rather than taking a near-match.
+
 ## 0.19.5 — 2026-08-08
 
 Three CVEs reported a control with no name and no requirement text. Their catalog entries held a bare string where the schema expects a control record, which was invisible until 0.19.4 began displaying the field and then rendered as `- undefined undefined:` in the gap report. All three describe the remediation clock for a KEV-listed flaw and now say so, closing the vulnerability-management gaps that already cite them. A malformed record is now omitted from the report rather than printed, so this class degrades to silence instead of noise, and the catalog test fails on the shape so it cannot recur unseen. Three further controls declared no framework gap at all and now name the ones they close.

package/data/_indexes/_meta.json

@@ -1,10 +1,10 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-08-09T04:06:57.598Z",
+  "generated_at": "2026-08-09T06:35:58.928Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 64,
   "source_hashes": {
-    "manifest.json": "d8a29cea517d6283eb77e3dafcf4b762bae6c4c4ceb7175ec07d61704adb8410",
+    "manifest.json": "aebdb8f8ea8f29fab794c12a13005fe2bca2d0185f2ca7c2217c9c813d27a059",
     "README.md": "0fa9b167172f104810e5ee6040f11ed741217f7a51c2552a15c69d2a15a164aa",
     "data/atlas-ttps.json": "a14089671efcb4f06dd0f82d688fe49276c1370e167e4483d76e9c0a40ef41eb",
     "data/attack-techniques.json": "6bc0619bcccceccc8d5c12aefa6c11197c625e5d7313e70474f2831e271b23f0",
@@ -16,7 +16,7 @@
     "data/framework-control-gaps.json": "a0a43cd0c8fff6ca753bb2c98f121922ff3de63102b7d67c86c76037e28cd553",
     "data/global-frameworks.json": "20b18a851b3ab82e57cd159b49476d69fe544f02523398b2015189ab81c7c3f8",
     "data/rfc-references.json": "6e9017eca910ab7e4bee85ad7c23927fd6ec766f34be7fce49ebf020cec3381a",
-    "data/zeroday-lessons.json": "e71be5d0f356ce0d249b8b01f348553b48d80213e693955f1ea9615b56aec918",
+    "data/zeroday-lessons.json": "aa12abe32c909f97d66be9f9a1be220e4dfd0fccf291eb59ef8ba185c03fa489",
     "skills/kernel-lpe-triage/skill.md": "0f79c641cef6e5f4a942eb94f43c460562bf83dfb67ae112d146c39c6b320fb0",
     "skills/ai-attack-surface/skill.md": "c97335e14cd34bd1cd3c9d2cbd397f33569a07292b2f2f7721483575eb4459f7",
     "skills/mcp-agent-trust/skill.md": "6195c93a6cadb213051214742890fa2bf4e39bae377a654d4195f0c90bd8b896",