@clear-capabilities/agentic-security-scanner 0.139.0 → 0.139.1

package/CHANGELOG.md

@@ -9,6 +9,46 @@
 > make the history less accurate, not more.
 
 
+## 0.139.1 — The same scanner, published with provenance
+
+**The shipped artifact is functionally identical to 0.139.0.** Only two commits
+separate them, and neither is in the published package: a test-harness timeout
+(`test/` does not ship) and a dependency hold (`.dependency-holds.json` does not
+ship). Nothing about how the scanner behaves has changed.
+
+This release exists for one reason: **0.139.0 was published without a provenance
+attestation.** It went out from a maintainer's laptop because the CI token
+lacked write access on the scoped package, so every tag-triggered publish failed
+at `PUT` with `E404` — after having already signed provenance to the Sigstore
+transparency log. The token has been replaced and verified (a re-run now returns
+`E403 "cannot publish over the previously published versions"`, which is the
+registry authenticating the write and rejecting only the duplicate version), so
+this is the first release published by CI with `--provenance`.
+
+For a security scanner that argues its case on *provable, measurable,
+reproducible*, "you can cryptographically verify this artifact was built from
+this commit in this repository" is a product property rather than a formality.
+Provenance is signed at publish time and cannot be retrofitted, which is why it
+takes a version number rather than an amendment to the last one.
+
+Fixes carried along, neither user-visible:
+
+- **`test/audit-cli.test.js` budgeted 4 s for a CLI that takes ~2.7 s idle** — a
+  1.5× margin in a suite that runs files concurrently. It failed as `status:
+  null` on a *different* test each run, was unreproducible in isolation, and
+  blocked a release push on a commit whose entire diff was 8 lines of JSON.
+  Now 30 s (~11× idle), still bounded so a genuinely hung CLI fails rather than
+  stalls.
+- **`@types/vscode` is held rather than upgraded.** It declares the VS Code API
+  surface the extension compiles against and should track `engines.vscode` — the
+  *oldest* supported host — not the newest published types. Chasing latest lets
+  the extension compile against APIs absent from hosts it claims to support, and
+  that failure lands as a runtime `TypeError` in a user's editor. The hold
+  records a pre-existing mismatch (`engines ^1.95.0` vs types `^1.125.0`) for a
+  deliberate decision at review time, since narrowing the supported host range
+  is a product call, not a dependency bump.
+
+
 ## 0.139.0 — Two detectors that were dead, a confinement rule that was documented but unenforced, and a new Go rule
 
 Every defect in this release is the same shape: **a control that exists, is

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clear-capabilities/agentic-security-scanner",
-  "version": "0.139.0",
+  "version": "0.139.1",
   "description": "Scanner engine for the agentic-security Claude Code plugin — SAST, SCA (function-level reachability + CISA KEV), secrets, IaC, prompt-injection, MCP/agent-tool audit, auth/authZ deep analysis, attack chains, PoC generation, business logic, toxic-combinations scoring, SBOM, pipeline integrity, compliance attestation, and more.",
   "type": "module",
   "main": "src/index.js",
@@ -127,5 +127,14 @@
     "test:ci-parity": "CI=true GITHUB_ACTIONS=true node --test test/backward-default.test.js test/ci-parity.test.js test/container-taint.test.js test/deep-taint.test.js test/engine-recall.test.js test/engine-reconnect.test.js test/gate-verdict-cache.test.js test/ignore-pragma.test.js test/java-taint-flow.test.js test/kt-taint-flow.test.js test/py-annotation-sources.test.js test/runscan-deep-option.test.js test/sanitizer-typed-flow.test.js"
   },
   "author": "Ross Young <ross@clearcapabilities.com>",
-  "license": "PolyForm-Internal-Use-1.0.0"
+  "license": "PolyForm-Internal-Use-1.0.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Clear-Capabilities/agentic-security.git",
+    "directory": "scanner"
+  },
+  "homepage": "https://github.com/Clear-Capabilities/agentic-security#readme",
+  "bugs": {
+    "url": "https://github.com/Clear-Capabilities/agentic-security/issues"
+  }
 }