@clear-capabilities/agentic-security-scanner 0.170.0 → 0.171.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +23 -0
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -9,6 +9,29 @@
|
|
|
9
9
|
> make the history less accurate, not more.
|
|
10
10
|
|
|
11
11
|
|
|
12
|
+
## 0.171.0 - documentation: surface every shipped PRD capability in the README and docs index
|
|
13
|
+
|
|
14
|
+
A documentation-only release. Auditing the docs against the actual CLI surface after PRD 5 shipped found
|
|
15
|
+
several real gaps — not cosmetic, actively misleading in one case — and fixed them:
|
|
16
|
+
|
|
17
|
+
- **README.md said built container images are NOT scanned.** That line predated `image scan`/`image verify`
|
|
18
|
+
(PRD 5, shipped in 0.170.0) and was flatly false by the time it shipped. Corrected, with a link to the new
|
|
19
|
+
guide below.
|
|
20
|
+
- **Seven of the repo's 17 slash-command dispatchers had no entry in README's own Commands list**:
|
|
21
|
+
`dataflow`, `governance`, `remediation`, `federate`, `image`, `provenance`, `runtime`. Added, grouped under
|
|
22
|
+
two new categories ("Data Flow Explorer" and "Source-to-artifact & runtime").
|
|
23
|
+
- **`docs/guides/runtime-twin.md` (PRD 2's own user guide) was an orphan** — reachable from one internal
|
|
24
|
+
cross-link, linked from neither README.md nor docs/README.md. Linked from both.
|
|
25
|
+
- **PRD 5 (Source-to-Artifact Security & Provenance) had no user-facing guide at all**, only the internal
|
|
26
|
+
`docs/implementation-status/` tracking doc. Added `docs/guides/artifact-provenance.md`.
|
|
27
|
+
- **`docs/reference/cli.md` — "every command, flag, and exit code" — was missing `proof`, `rules`, `fleet`,
|
|
28
|
+
`runtime`, `image`, `provenance`, and `supply` entirely** from its own Commands table (the literal CLI
|
|
29
|
+
surface of PRDs 1, 3, 4, 2, and 5). Added all seven.
|
|
30
|
+
- Added two new "What makes it different" bullets (runtime corroboration, source-to-artifact tracing) and a
|
|
31
|
+
`supply --vex` mode mention to README's Commands list.
|
|
32
|
+
|
|
33
|
+
No code changed; `scanner/dist/agentic-security.mjs` is unchanged.
|
|
34
|
+
|
|
12
35
|
## 0.170.0 - source-to-artifact security & provenance: a new `src/artifact/` package, `image`/`provenance` CLI, VEX
|
|
13
36
|
|
|
14
37
|
Binds a finding to the actual **built artifact** (a container image, today) that ships it — closing the gap
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@clear-capabilities/agentic-security-scanner",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.171.0",
|
|
4
4
|
"description": "Scanner engine for the agentic-security Claude Code plugin: SAST, SCA with reachability and CISA KEV, secrets, IaC, Haskell and Nix/NixOS, prompt-injection, MCP/agent-tool audit, authZ analysis, SBOM, compliance attestation, and more.",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"main": "src/index.js",
|