@blamejs/exceptd-skills 0.19.5 → 0.19.7

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## 0.19.7 — 2026-08-09
+
+Another 66 CVEs report the controls they require, taking coverage to 424 of 1025. The set reaches beyond appliances into Roundcube and Zimbra webmail, SmarterMail, WatchGuard Firebox, VMware Aria Operations, GitLab, Vite, Windows NTFS, FreePBX and the Apple and Ivanti mobile estate.
+
+Two requirements dominate where the affected asset manages other assets. A device-management gateway reached before authentication is a fleet event rather than a host event: the vendor fix closes the injection path but leaves every configuration profile pushed, certificate issued and credential that transited the server untouched, so the requirement covers revoking what the server issued and invalidating device trust state, not just installing the update. And on a mobile estate the operative failure is deferral — an update prompt dismissed on a personally-carried device extends exposure to a confirmed-exploited kernel flaw for weeks while the console still reports the fleet as managed — so the requirement is enforcement with a deadline and loss of access past it, not a patch-level report.
+
+Entries state their own limits. Where a control bounds the damage without preventing the flaw, it says so rather than implying prevention; where the vendor ships no fix, the requirement describes the compensating control instead of a patch window.
+
+## 0.19.6 — 2026-08-08
+
+Another 48 CVEs report the controls they require, taking the catalog to 358 of 1025. The set spans SharePoint and SolarWinds Web Help Desk deserialization, Samsung MagicINFO and SimpleHelp path traversal, Fortinet FortiClient EMS, Ivanti Endpoint Manager, CRI-O and containerd, and the Apple and Chromium memory-safety entries.
+
+Three requirements recur because the vulnerabilities keep demonstrating them. Where a vendor fix exists but needs a service restart the frameworks let operators defer, the remediation clock has to budget the restart rather than count the installer run as done. Where exploitation writes something that outlives the fix — an uploaded web shell, a resident implant — patching closes the entry point without evicting what came through it, so a process whose terminal state is "patched" leaves the foothold in place. And where a product is commissioned once and left outside the fleet patch cadence, a signage server or a remote-support server, the listing date is the only thing that pulls it back into scope.
+
+Entries name the framework controls they close and carry a test that separates the control being present from it being effective. Where no control in the inventory fits a CVE without a category error, the entry stays empty rather than taking a near-match.
+
 ## 0.19.5 — 2026-08-08
 
 Three CVEs reported a control with no name and no requirement text. Their catalog entries held a bare string where the schema expects a control record, which was invisible until 0.19.4 began displaying the field and then rendered as `- undefined undefined:` in the gap report. All three describe the remediation clock for a KEV-listed flaw and now say so, closing the vulnerability-management gaps that already cite them. A malformed record is now omitted from the report rather than printed, so this class degrades to silence instead of noise, and the catalog test fails on the shape so it cannot recur unseen. Three further controls declared no framework gap at all and now name the ones they close.

package/data/_indexes/_meta.json

@@ -1,10 +1,10 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-08-09T04:06:57.598Z",
+  "generated_at": "2026-08-09T10:13:44.639Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 64,
   "source_hashes": {
-    "manifest.json": "d8a29cea517d6283eb77e3dafcf4b762bae6c4c4ceb7175ec07d61704adb8410",
+    "manifest.json": "25e19ace806ba31cd59aa023427d4969fc610c0cd039f51f49aa7bba8836a5f4",
     "README.md": "0fa9b167172f104810e5ee6040f11ed741217f7a51c2552a15c69d2a15a164aa",
     "data/atlas-ttps.json": "a14089671efcb4f06dd0f82d688fe49276c1370e167e4483d76e9c0a40ef41eb",
     "data/attack-techniques.json": "6bc0619bcccceccc8d5c12aefa6c11197c625e5d7313e70474f2831e271b23f0",
@@ -16,7 +16,7 @@
     "data/framework-control-gaps.json": "a0a43cd0c8fff6ca753bb2c98f121922ff3de63102b7d67c86c76037e28cd553",
     "data/global-frameworks.json": "20b18a851b3ab82e57cd159b49476d69fe544f02523398b2015189ab81c7c3f8",
     "data/rfc-references.json": "6e9017eca910ab7e4bee85ad7c23927fd6ec766f34be7fce49ebf020cec3381a",
-    "data/zeroday-lessons.json": "e71be5d0f356ce0d249b8b01f348553b48d80213e693955f1ea9615b56aec918",
+    "data/zeroday-lessons.json": "fdd6944844660d6057c531c3046b3f7bb665260c1986c82a9b9755eeb6d93e56",
     "skills/kernel-lpe-triage/skill.md": "0f79c641cef6e5f4a942eb94f43c460562bf83dfb67ae112d146c39c6b320fb0",
     "skills/ai-attack-surface/skill.md": "c97335e14cd34bd1cd3c9d2cbd397f33569a07292b2f2f7721483575eb4459f7",
     "skills/mcp-agent-trust/skill.md": "6195c93a6cadb213051214742890fa2bf4e39bae377a654d4195f0c90bd8b896",

package/data/_indexes/activity-feed.json

@@ -5,6 +5,14 @@
     "event_count": 63
   },
   "events": [
+    {
+      "date": "2026-08-09",
+      "type": "catalog_update",
+      "artifact": "data/zeroday-lessons.json",
+      "path": "data/zeroday-lessons.json",
+      "schema_version": "1.1.0",
+      "entry_count": 1025
+    },
     {
       "date": "2026-08-08",
       "type": "catalog_update",
@@ -29,14 +37,6 @@
       "schema_version": "1.0.0",
       "entry_count": 1025
     },
-    {
-      "date": "2026-08-08",
-      "type": "catalog_update",
-      "artifact": "data/zeroday-lessons.json",
-      "path": "data/zeroday-lessons.json",
-      "schema_version": "1.1.0",
-      "entry_count": 1025
-    },
     {
       "date": "2026-08-06",
       "type": "catalog_update",

package/data/_indexes/catalog-summaries.json

@@ -229,7 +229,7 @@
       "path": "data/zeroday-lessons.json",
       "purpose": "Distilled lessons from notable zero-days and campaigns (SesameOp, Copy Fail, Dirty Frag, Copilot RCE, Windsurf MCP). Each entry: technique, distinguishing characteristic, what it means for the framework lag.",
       "schema_version": "1.1.0",
-      "last_updated": "2026-08-08",
+      "last_updated": "2026-08-09",
       "tlp": "CLEAR",
       "source_confidence_default": "B2",
       "freshness_policy": {