@blamejs/exceptd-skills 0.21.10 → 0.21.12

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 0.21.12 — 2026-09-28
+
+The `affected` text on 306 catalog entries and the vendor update path on 19 no longer name raw catalog fields. "Microsoft Windows — see vendor advisory linked in verification_sources for affected version ranges." now reads "Microsoft Windows. The affected version ranges are in the vendor advisory this entry links to.", and the update path reads "Apply the vendor security update per the vendor advisory this entry links to". The two TeleMessage TM SGNL entries (CVE-2025-48927 and CVE-2025-48928) link no vendor advisory, and their text now says so and names CISA's KEV entry and the NVD record as the sources. Their affected versions now read "TeleMessage TM SGNL service as operated through 2025-05-05 (per the NVD record); no version range is published", in place of "versions per vendor advisory", and their first behavioral indicator no longer refers to a fixed release named in a vendor advisory. The indicator source notes on these two entries no longer cite a vendor advisory. On CVE-2008-4250, CVE-2009-1537, CVE-2009-3459, CVE-2010-0249 and CVE-2010-0806, the first behavioral indicator and its source note now name the fixing bulletin the NVD record references (MS08-067, MS09-028, APSB09-15, MS10-002 and MS10-018) in place of a vendor advisory the entry does not record, and the note on CVE-2025-1316 names CISA ICS advisory ICSA-25-063-08 rather than an Edimax advisory. The Edimax IC-7100 entry (CVE-2025-1316) now names CISA ICS advisory ICSA-25-063-08 as the source of its affected builds, and the node-ipc entry no longer points to a verification-sources note that does not exist.
+
+26 of these texts repeated the vendor in the product name or carried a doubled space. "SimpleHelp  SimpleHelp", "Kentico Kentico Xperience" and "Erlang Erlang/OTP" now read "SimpleHelp", "Kentico Xperience" and "Erlang/OTP".
+
+## 0.21.11 — 2026-09-28
+
+446 zero-day lesson texts and 7 catalog fields on 341 CVEs no longer cite the curation input. Evidence and control texts that read "Packet records cisa_kev true with kev_date 2025-10-02, poc_available true" or "the packet places the defect in ..." now state each fact in a sentence and name its source where there is one: CISA's KEV entry, the vendor advisory, or a framework gap recorded for the entry. Every quotation attributed to CISA's KEV entry matches the KEV record. The catalog gap audit's `pipeline-wording` class now reports no texts, and the predeploy budget gate holds it at 0.
+
+The discovery note on CVE-2017-17562 said the KEV entry lists no vendor. The KEV entry names Embedthis as the vendor and links no vendor advisory, and the note now says so.
+
+`scripts/audit-catalog-gaps.js` now lists every extended class it covers under `totals.extended` and `extended_findings`, with a count of 0 for a class that has no findings. It used to leave such a class out, so `--class pipeline-wording` returned no count at all once the class reached 0.
+
 ## 0.21.10 — 2026-09-28
 
 626 catalog and zero-day lesson texts on 240 CVEs no longer say that CISA's KEV required action calls for a restart or reboot. CISA's required action for these CVEs says to apply mitigations per vendor instructions, follow BOD 22-01 guidance for cloud services, or discontinue use of the product. Every one of these entries records `patch_required_reboot: true`, so each text keeps the restart and drops only the attribution: "the vendor patch typically requires a service restart or system reboot per the KEV requiredAction" now ends at "system reboot". 239 of the texts are `live_patch_notes` fields in the catalog.

package/data/_indexes/_meta.json

@@ -1,14 +1,14 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-09-28T20:42:47.146Z",
+  "generated_at": "2026-09-28T23:54:38.368Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 64,
   "source_hashes": {
-    "manifest.json": "8ef779db5095182e6cbbfccbcc875a58733b16da9703b359a550b06544ab539a",
+    "manifest.json": "c80b84138d5924a476f6b519bb0da79cbdb7d813283b91c17eb4406d7dc50292",
     "README.md": "864570c1f7fb221b0176d22d3b0823a8d077d6a7209edc6045b426b1e9ec555d",
     "data/atlas-ttps.json": "c36c0a27c8de8a37a7070923d7b187345c46db9db778f58e4637f1f81ca6d6b1",
     "data/attack-techniques.json": "9857a11bd035c8638e61b200cdabea0cc43f0115b239e4941a19682076a1cfd3",
-    "data/cve-catalog.json": "839b8354bd39025286484148b862661fa79ecef835165be86e9205801f73c070",
+    "data/cve-catalog.json": "09b9cf2690e17850f2134421dc3559e15426644b59f1eee31ba3e7f44d248770",
     "data/cwe-catalog.json": "2116d47911a3e50b46495b51a31b12d0aede23233a62ef1362cb72810680b57c",
     "data/d3fend-catalog.json": "feec37e4b0a40cd7bc14616b50e7b9bcdb58a92d8e9326f9e2e632896d8ea576",
     "data/dlp-controls.json": "791f6a46b19b0c0fa2f46630ac8b398afb7ec9c2f2019056828c8820fe255f19",
@@ -16,7 +16,7 @@
     "data/framework-control-gaps.json": "79e40362b0a71582a88dd2f4af70715218cef45fb9d3e1c00955bda642dda089",
     "data/global-frameworks.json": "86249047c50d2584b4854eb381ba53c309c0e6e29d4cb0e522b4ba1405481de6",
     "data/rfc-references.json": "6e9017eca910ab7e4bee85ad7c23927fd6ec766f34be7fce49ebf020cec3381a",
-    "data/zeroday-lessons.json": "498d99a8ea35cec3ef929bb8082e2e38f0991c44004343666c477d1adf5087b6",
+    "data/zeroday-lessons.json": "ac5ffd458028b3aef7140f99e00f4cefe749c4b19101f396c98ac6409874ed1b",
     "skills/kernel-lpe-triage/skill.md": "78a547771c42b9348a1f80201e0f1b8a5ed3e7b4f15b35b1f64cf4ee54b0480b",
     "skills/ai-attack-surface/skill.md": "bc9084127e4e928cba439187025f9e77aaca8089fe64891312824e74dd9fdb5b",
     "skills/mcp-agent-trust/skill.md": "c20bda4c1267b16db4f713667216d93e0ab4b98c0fb244024749dcfb32d709cf",