@clear-capabilities/agentic-security-scanner 0.195.0 → 0.195.3

package/CHANGELOG.md

@@ -9,6 +9,35 @@
 > make the history less accurate, not more.
 
 
+## 0.195.3 - The VS Code extension's build tool no longer pulls in a vulnerable minimatch
+
+Why: the 0.195.2 release workflow stopped at its dependency check. A new advisory (GHSA-g3hv-75wg-m249, moderate, denial of service in minimatch before 11.0.1) reached `ide/vscode` through `@vscode/vsce`, which asks for `minimatch ^10.2.6`. The check passed on the same tree 16 minutes earlier, so the advisory was published during the release. Nothing was published to npm for 0.195.2; its tag exists and points at a commit that failed the gate, so the fix ships as 0.195.3.
+
+- **`ide/vscode` overrides `minimatch` to `^11.0.1`** (the only fixed line). `npm audit` reports 0 vulnerabilities; the extension still builds and type-checks. The override can be dropped when `@vscode/vsce` raises its own range.
+- **Carries everything in 0.195.2:** trend jobs off pull requests, the cabal-store-only cache fix.
+- **Measured for the 0.195.2 attempt (not a release):** push 313 s, hosted checks 702 s (cold cabal cache under the new key, plus one timing check re-run), release workflow 162 s to the failed gate.
+
+## 0.195.2 - Trend jobs no longer take runner slots from the blocking jobs on a pull request
+
+Why: the release requirement is under 10 minutes. On the 0.195.1 pull request the `ci` workflow started about 33 jobs at once and blocking jobs waited up to 200 s for a runner, while five informational jobs that nothing waits on held slots for 20 to 44 minutes (`local-model`, `realworld-bench`, `synthetic-bench`, `jetbrains-plugin`, `chrome-exports`). They only delayed the jobs that decide whether the change can merge.
+
+- **`local-model`, `jetbrains-plugin` and `chrome-exports` run on pushes to `main`, not on pull requests** (`if: github.event_name != 'pull_request'`). A skipped job counts as passing in the hosted-CI check, and each still reports on every merge.
+- **`bench.yml` (synthetic, real-world and SARD smoke trends) runs on its daily schedule and on demand, not on pull requests.** This reverses the pull request trigger its header had kept on purpose; the header now says why. The blocking correctness gates (`corpus`, `bench-gates`, `bench-gates-b`, mutation) still run on every pull request.
+- **`language-tools-ghc` caches the cabal store only, under a new key.** 0.195.1 also cached `~/.ghc`; once that cache became readable, `cabal install --lib` refused to overwrite the packages the restored environment already listed and the job failed on the 0.195.2 pull request. The environment file is rebuilt from the store in seconds.
+- **Unchanged on purpose:** `nixos-runtime` still runs on pull requests, because the release closure attests it for the commit being tagged.
+- **Measurement:** the next `TIMINGS` line is the result for this change; it is not claimed here. Releasing a commit already merged through its own pull request is `ship --release-only`, which waits only for the hosted release workflow.
+
+## 0.195.1 - Hosted CI split so its slowest blocking job is about four minutes, not twelve
+
+Why: the requirement is a release in under 10 minutes once the code is committed. Measured on the 0.195.0 pull request, the slowest blocking hosted job was `language-suites` at 12.1 min, then `language-tools-ghc` 10 min, the test shards 6 to 8 min, `bench-gates` 6.4 min and `proof-container` 5.3 min, and the release workflow after the tag is about 4.8 min (75 s waiting for a runner, 145 s for the `rest` gate leg, 66 s to publish). CI then the release workflow in series cannot fit 10 minutes unless the longest CI job is cut to about 4.
+
+- **The test suite runs in eight shards instead of four** (`test-shard (1/8)` to `(8/8)`; the aggregator `test` keeps its name). A shard took 4.7 to 6.9 min of test time.
+- **`language-suites` is four jobs.** The CLI-driven suites (`language-slow`, 242 s), the benchmark gates (`language-gates`, 132 s) and the stress run (`language-stress`, 235 s) moved to their own jobs; `language-suites` keeps the Haskell, Nix, language and registry steps (about 100 s). All four are blocking.
+- **`bench-gates` is two jobs** (`bench-gates`: self-scan; `bench-gates-b`: mutation, fix verification, layer recall, Haskell precision).
+- **`language-tools-ghc` restores the cabal store** from `actions/cache` (the package build was 499 s of its 10 min). The first run on a given key is cold, and a cache saved on a pull request is not readable by other branches, so the first warm run is after this lands on `main`.
+- **`proof-container` pulls its five images side by side** instead of one after another (the pull step was 64 s).
+- **Not measured end to end at the time of writing.** The next two `TIMINGS` lines are the measurement: this release (cold cache) and the one after it (warm). Not changed: the release workflow, the npm registry's own delay before a new version is listed (about 5 min after a successful publish on 0.194.1 and 0.195.0), and the pre-push gate. Whether the whole path fits 10 minutes is a result of the next release, not a claim made here.
+
 ## 0.195.0 - A release is cut from one command, and a release-only ship
 
 Why: the 0.194.1 release (dependency bumps only) took 1 h 49 min end to end. A clean run is about 41 minutes (push 1062 s, hosted checks 963 s, release workflow 316 s, the rest seconds); the other 68 minutes were two failed attempts, each found 15 minutes in, because the hand-made version bump missed two generated files that record the version (`inventory.json`, `captured.json`). `scripts/release-prepare.mjs` already existed to regenerate them and was not used.

package/dist/{4aabdb1fd3b719b84a6b.json → 1b417277abe49edb427f.json}

@@ -1,6 +1,6 @@
 {
   "name": "@clear-capabilities/agentic-security-scanner",
-  "version": "0.195.0",
+  "version": "0.195.3",
   "description": "Scanner engine for the agentic-security Claude Code plugin: SAST, SCA with reachability and CISA KEV, secrets, IaC, Haskell and Nix/NixOS, prompt-injection, MCP/agent-tool audit, authZ analysis, SBOM, compliance attestation, and more.",
   "type": "module",
   "main": "src/index.js",