@clear-capabilities/agentic-security-scanner 0.153.0 → 0.153.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +19 -0
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -9,6 +9,25 @@
|
|
|
9
9
|
> make the history less accurate, not more.
|
|
10
10
|
|
|
11
11
|
|
|
12
|
+
## 0.153.1 - CI hygiene: off the deprecated Node 20 Actions runtime
|
|
13
|
+
|
|
14
|
+
A maintenance-only release, no engine or scanner behavior changes.
|
|
15
|
+
|
|
16
|
+
- **GitHub Actions upgraded off the deprecated Node.js 20 runtime**: `github/codeql-action/{init,analyze}`
|
|
17
|
+
(v3 → v4), `actions/setup-java` (v4 → v6), `gradle/actions/setup-gradle` (v4 → v6),
|
|
18
|
+
`actions/upload-artifact` (v4 → v7), `actions/download-artifact` (v5 → v8), and
|
|
19
|
+
`actions/github-script` (v8 → v9) — all confirmed against each action's own latest published
|
|
20
|
+
release. `ci.yml` also gained the `FORCE_JAVASCRIPT_ACTIONS_TO_NODE24` env var every other
|
|
21
|
+
workflow in this repo already sets.
|
|
22
|
+
- **`@types/node` bumped one patch** (0.153.0 shipped with 26.6.2; latest is 26.6.3) in both
|
|
23
|
+
`scanner/` and `ide/vscode/`, caught by running the project's own `dependency-currency.mjs` gate
|
|
24
|
+
locally — a dev-only, types-only dependency, so the bundle is byte-identical.
|
|
25
|
+
- Note for anyone who saw a GitHub Actions annotation naming an old Ubuntu version: that notice
|
|
26
|
+
(`ubuntu-latest` migrating to Ubuntu 26 around October 2026) is informational only — every
|
|
27
|
+
workflow in this repo already uses the floating `ubuntu-latest`/`macos-latest` labels, which
|
|
28
|
+
resolve to the new image automatically with no action required.
|
|
29
|
+
|
|
30
|
+
|
|
12
31
|
## 0.153.0 - Taint-engine points-to precision, and two default-adjacent capabilities rebuilt from broken to sound
|
|
13
32
|
|
|
14
33
|
Four taint-engine capabilities landed since 0.152.0, continuing the "next-generation taint analysis
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@clear-capabilities/agentic-security-scanner",
|
|
3
|
-
"version": "0.153.
|
|
3
|
+
"version": "0.153.1",
|
|
4
4
|
"description": "Scanner engine for the agentic-security Claude Code plugin — SAST, SCA (function-level reachability + CISA KEV), secrets, IaC, prompt-injection, MCP/agent-tool audit, auth/authZ deep analysis, attack chains, PoC generation, business logic, toxic-combinations scoring, SBOM, pipeline integrity, compliance attestation, and more.",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"main": "src/index.js",
|