@bongos/core 1.19.312 → 1.19.313

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.312",
-  "core_contract": "1.19.312",
-  "source_commit": "1115918f0f231eb592993c52535bccf7459ba201",
+  "core_version": "1.19.313",
+  "core_contract": "1.19.313",
+  "source_commit": "f0f640457ac94cf62a4704d54abe9aa58632e183",
   "source_ref": "HEAD",
-  "built_at": "2026-08-23T20:51:36.647Z",
+  "built_at": "2026-08-23T21:45:16.664Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 323,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1766,
-  "tree_sha256": "8fa5a70e1592609c53386120743ab236e02cd64aaf8c3911891bd79d6a8da6ea",
+  "tree_sha256": "92e06651a3b977ed15aece09dd42e0fa33db37b85170d195d0c1f8a11840144b",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -4582,12 +4582,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "57b834edcb83e8b41bb7535bbacc1740537b0f3551726295884ea35615a88686"
+      "sha256": "3e04f2907dd0a7d2cefbde8ae36e307e28fc703febd443d15fd2f204425d534d"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "7e8d9420573b8eabbe2ad7f96f0317d4b454fcf5788b68bfc6afdf6fb45b3cb4"
+      "sha256": "81d11724ce5ac12446cf9d80adebe66eef5c8e5dc9082fc12ab493dbff60746a"
     },
     {
       "path": "public-docs/index.html",
@@ -6257,7 +6257,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "a35a7a2ca59f77d06b12aaaec28b4d82bbe5a4713289c072d4e9cc45d0d467e5"
+      "sha256": "b62609c76a5f302081de9ddec668656fd4d498dd10c545e9f108c4bf764e0ef8"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -6422,7 +6422,7 @@
     {
       "path": "tests/audit_gate.mjs",
       "mode": "0000644",
-      "sha256": "af91c6018f572d9cb0a213b40ec7953f9f81cc20a33634fb5a66615a1649fee8"
+      "sha256": "ee9dc18e86ac819235d7215f0cee14ff7bfc8d07c46eba6895c23f99c7d0ae0e"
     },
     {
       "path": "tests/audit_middleware.mjs",

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.312",
+  "version": "1.19.313",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.312",
+      "version": "1.19.313",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",
@@ -48,9 +48,9 @@
       }
     },
     "node_modules/body-parser": {
-      "version": "1.20.5",
-      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.5.tgz",
-      "integrity": "sha512-3grm+/2tUOvu2cjJkvsIxrv/wVpfXQW4PsQHYm7yk4vfpu7Ekl6nEsYBoJUL6qDwZUx8wUhQ8tR2qz+ad9c9OA==",
+      "version": "1.20.6",
+      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.6.tgz",
+      "integrity": "sha512-p5tAzS57i5MV9fZFDj9LeIiTZEufbSe2eDozP+ElheSUq1m74CRq1jI4mYNDdVs9vQztXFLuk/Gd6BWTdwRJ5g==",
       "license": "MIT",
       "dependencies": {
         "bytes": "~3.1.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.312",
+  "version": "1.19.313",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",
@@ -29,6 +29,6 @@
     "pino": "^9.14.0"
   },
   "overrides": {
-    "undici": "^6.27.0"
+    "undici": "^6.28.0"
   }
 }

package/src/module-api.js

@@ -1051,8 +1051,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.310 with no explicit bump. run 32665535518. (task 1002620)
 //   1.19.312 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.311 with no explicit bump. run 32665664699. (task 1002620)
+//   1.19.313 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.312 with no explicit bump. run 32668457836. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.312'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.313'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/audit_gate.mjs

@@ -79,9 +79,14 @@ test('empty/missing baseline means every high gates (the fresh-repo case)', () =
   assert.equal(v.newAdvisory.length, 2, 'the two undici moderates advise');
 });
 
+// task 1003201 (goal 1000079) drove the baseline to ZERO — every advisory it
+// recorded is fixed, not tolerated. An empty findings[] is therefore the goal
+// state, not a broken file; the shape assertions below still hold if debt ever
+// reappears. (It must stay an array — a missing/!array findings would make the
+// gate silently treat every new high as pre-existing.)
 test('the committed baseline file parses and only carries known severities', () => {
   const b = require(path.join(ROOT, 'config', 'audit-baseline.json'));
-  assert.ok(Array.isArray(b.findings) && b.findings.length > 0);
+  assert.ok(Array.isArray(b.findings), 'findings must be an array (empty = no tolerated debt)');
   for (const f of b.findings) {
     assert.ok(['low', 'moderate', 'high', 'critical', 'info', 'unknown'].includes(f.severity), `odd severity ${f.severity}`);
     assert.ok(f.id && f.name, 'baseline entries carry advisory id + package');