@blamejs/exceptd-skills 0.21.11 → 0.21.13

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.21.13 — 2026-09-28
+
+472 catalog and zero-day lesson texts on 337 entries no longer quote raw catalog field names as prose. An evidence text that read "KEV-listed 2024-11-18 with active_exploitation confirmed, poc_available true, RWEP 82" now reads "CISA added it to its Known Exploited Vulnerabilities catalog on 2024-11-18. Active exploitation is confirmed, a proof of concept is available, and the entry carries an RWEP score of 82", and "patch_required_reboot is false" now reads "applying the fix does not require a reboot". The rewritten texts include 324 lesson evidence and control texts, 44 `live_patch_notes`, 37 `poc_description` and 15 `rwep_correction_note` fields. Four indicators on CVE-2026-31431, CVE-2026-46300 and CVE-2026-39987 now test for a version "in the affected version range listed for this entry". The RWEP factor breakdowns in `rwep_notes` still use the scoring formula's field names.
+
+The KEV scope note on CVE-2026-45321 said the entry was correctly recorded as not KEV-listed, but CISA added CVE-2026-45321 to KEV on 2026-05-27. The discovery note on CVE-2022-22620 said its discovery source was recorded as unknown, but the entry records a human researcher. Both notes now match their entries.
+
+## 0.21.12 — 2026-09-28
+
+The `affected` text on 306 catalog entries and the vendor update path on 19 no longer name raw catalog fields. "Microsoft Windows — see vendor advisory linked in verification_sources for affected version ranges." now reads "Microsoft Windows. The affected version ranges are in the vendor advisory this entry links to.", and the update path reads "Apply the vendor security update per the vendor advisory this entry links to". The two TeleMessage TM SGNL entries (CVE-2025-48927 and CVE-2025-48928) link no vendor advisory, and their text now says so and names CISA's KEV entry and the NVD record as the sources. Their affected versions now read "TeleMessage TM SGNL service as operated through 2025-05-05 (per the NVD record); no version range is published", in place of "versions per vendor advisory", and their first behavioral indicator no longer refers to a fixed release named in a vendor advisory. The indicator source notes on these two entries no longer cite a vendor advisory. On CVE-2008-4250, CVE-2009-1537, CVE-2009-3459, CVE-2010-0249 and CVE-2010-0806, the first behavioral indicator and its source note now name the fixing bulletin the NVD record references (MS08-067, MS09-028, APSB09-15, MS10-002 and MS10-018) in place of a vendor advisory the entry does not record, and the note on CVE-2025-1316 names CISA ICS advisory ICSA-25-063-08 rather than an Edimax advisory. The Edimax IC-7100 entry (CVE-2025-1316) now names CISA ICS advisory ICSA-25-063-08 as the source of its affected builds, and the node-ipc entry no longer points to a verification-sources note that does not exist.
+
+26 of these texts repeated the vendor in the product name or carried a doubled space. "SimpleHelp  SimpleHelp", "Kentico Kentico Xperience" and "Erlang Erlang/OTP" now read "SimpleHelp", "Kentico Xperience" and "Erlang/OTP".
+
 ## 0.21.11 — 2026-09-28
 
 446 zero-day lesson texts and 7 catalog fields on 341 CVEs no longer cite the curation input. Evidence and control texts that read "Packet records cisa_kev true with kev_date 2025-10-02, poc_available true" or "the packet places the defect in ..." now state each fact in a sentence and name its source where there is one: CISA's KEV entry, the vendor advisory, or a framework gap recorded for the entry. Every quotation attributed to CISA's KEV entry matches the KEV record. The catalog gap audit's `pipeline-wording` class now reports no texts, and the predeploy budget gate holds it at 0.

package/data/_indexes/_meta.json

@@ -1,14 +1,14 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-09-28T21:45:53.908Z",
+  "generated_at": "2026-09-29T00:53:16.565Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 64,
   "source_hashes": {
-    "manifest.json": "4458e5bbea371c93b1bd8b496097a9bd5cd9c99b3ac62d99b056e53e7ced9ebc",
+    "manifest.json": "04d3d604468a2688e45b55b5604d442b81e7f1f32b06c5ae6afbe5ea96cd7923",
     "README.md": "864570c1f7fb221b0176d22d3b0823a8d077d6a7209edc6045b426b1e9ec555d",
     "data/atlas-ttps.json": "c36c0a27c8de8a37a7070923d7b187345c46db9db778f58e4637f1f81ca6d6b1",
     "data/attack-techniques.json": "9857a11bd035c8638e61b200cdabea0cc43f0115b239e4941a19682076a1cfd3",
-    "data/cve-catalog.json": "d225c9429a16992716ad62db3779cede31ed776bd9319c4f3a8d28269d09732c",
+    "data/cve-catalog.json": "1b066a7f2b9ae3d7a30870d043f718e6f8f39efbd3c72c834a88d1a8f34b4fde",
     "data/cwe-catalog.json": "2116d47911a3e50b46495b51a31b12d0aede23233a62ef1362cb72810680b57c",
     "data/d3fend-catalog.json": "feec37e4b0a40cd7bc14616b50e7b9bcdb58a92d8e9326f9e2e632896d8ea576",
     "data/dlp-controls.json": "791f6a46b19b0c0fa2f46630ac8b398afb7ec9c2f2019056828c8820fe255f19",
@@ -16,7 +16,7 @@
     "data/framework-control-gaps.json": "79e40362b0a71582a88dd2f4af70715218cef45fb9d3e1c00955bda642dda089",
     "data/global-frameworks.json": "86249047c50d2584b4854eb381ba53c309c0e6e29d4cb0e522b4ba1405481de6",
     "data/rfc-references.json": "6e9017eca910ab7e4bee85ad7c23927fd6ec766f34be7fce49ebf020cec3381a",
-    "data/zeroday-lessons.json": "ac5ffd458028b3aef7140f99e00f4cefe749c4b19101f396c98ac6409874ed1b",
+    "data/zeroday-lessons.json": "2862a4be526374cca633cc47f034b70e1988bb28ebaa22314174b9b3a36a27b2",
     "skills/kernel-lpe-triage/skill.md": "78a547771c42b9348a1f80201e0f1b8a5ed3e7b4f15b35b1f64cf4ee54b0480b",
     "skills/ai-attack-surface/skill.md": "bc9084127e4e928cba439187025f9e77aaca8089fe64891312824e74dd9fdb5b",
     "skills/mcp-agent-trust/skill.md": "c20bda4c1267b16db4f713667216d93e0ab4b98c0fb244024749dcfb32d709cf",