@clear-capabilities/agentic-security-scanner 0.195.3 → 0.195.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/CHANGELOG.md
CHANGED
|
@@ -9,6 +9,14 @@
|
|
|
9
9
|
> make the history less accurate, not more.
|
|
10
10
|
|
|
11
11
|
|
|
12
|
+
## 0.195.4 - `ship` stops running the local early release gate by default, and reports the release clock
|
|
13
|
+
|
|
14
|
+
Why: on 0.195.3 the hosted checks were green after 6.6 minutes, but the merge waited another 5 minutes for the local early release gate (the release closure on the PR head), which the hosted release workflow's full gate then repeats with the cache off. The release requirement is under 10 minutes from a merged, green `main` to a successful publish.
|
|
15
|
+
|
|
16
|
+
- **The local early release gate is opt-in (`ship --local-gate`).** By default `ship` runs only the eight publish blockers locally after the merge, requires the hosted blocking checks to be green, and leaves the full gate to the hosted release workflow, whose `publish` job needs every leg. What is given up: a local run of the execution half of the release closure before the tag. Nothing is bypassed and no gate was removed from the hosted path.
|
|
17
|
+
- **`TIMINGS` ends with `release-clock=Ns`** (merge, verify, tag and release) when all four phases finished. This is the figure the 10 minute requirement is measured on; the registry's listing delay and the pre-merge work are outside it.
|
|
18
|
+
- **Measurement:** not claimed here. The next `TIMINGS` line from a default `ship` is the first.
|
|
19
|
+
|
|
12
20
|
## 0.195.3 - The VS Code extension's build tool no longer pulls in a vulnerable minimatch
|
|
13
21
|
|
|
14
22
|
Why: the 0.195.2 release workflow stopped at its dependency check. A new advisory (GHSA-g3hv-75wg-m249, moderate, denial of service in minimatch before 11.0.1) reached `ide/vscode` through `@vscode/vsce`, which asks for `minimatch ^10.2.6`. The check passed on the same tree 16 minutes earlier, so the advisory was published during the release. Nothing was published to npm for 0.195.2; its tag exists and points at a commit that failed the gate, so the fix ships as 0.195.3.
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@clear-capabilities/agentic-security-scanner",
|
|
3
|
-
"version": "0.195.
|
|
3
|
+
"version": "0.195.4",
|
|
4
4
|
"description": "Scanner engine for the agentic-security Claude Code plugin: SAST, SCA with reachability and CISA KEV, secrets, IaC, Haskell and Nix/NixOS, prompt-injection, MCP/agent-tool audit, authZ analysis, SBOM, compliance attestation, and more.",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"main": "src/index.js",
|