@discretion/core 0.1.0 → 0.1.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +19 -0
- package/package.json +2 -2
package/CHANGELOG.md
CHANGED
|
@@ -11,6 +11,25 @@ one.**
|
|
|
11
11
|
|
|
12
12
|
Nothing yet.
|
|
13
13
|
|
|
14
|
+
## [0.1.1] — provenance republish
|
|
15
|
+
|
|
16
|
+
**No code change. `0.1.1` is byte-identical to `0.1.0`.**
|
|
17
|
+
|
|
18
|
+
Published because `0.1.0`'s provenance attestation references a commit that no
|
|
19
|
+
longer exists. The repository's history was rewritten to strip a
|
|
20
|
+
`Co-Authored-By` trailer from all 161 commits, which changed every commit SHA.
|
|
21
|
+
The SLSA attestations for `0.1.0` name `d315abc` (core) and `2d09fb3` (data),
|
|
22
|
+
and neither is reachable from the rewritten history.
|
|
23
|
+
|
|
24
|
+
Nothing about `0.1.0` is unsafe: its tarball, signature and Sigstore
|
|
25
|
+
transparency-log entries all remain valid. What broke is the link back to
|
|
26
|
+
source — and for a package whose stated claim is that it can be audited, a
|
|
27
|
+
provenance record pointing at a missing commit is worth a version number to
|
|
28
|
+
fix.
|
|
29
|
+
|
|
30
|
+
**Prefer `0.1.1`.** Use `0.1.0` only if you have a reason to, and know that
|
|
31
|
+
verifying its provenance against this repository will fail.
|
|
32
|
+
|
|
14
33
|
## [0.1.0] — first published release
|
|
15
34
|
|
|
16
35
|
The engine has existed and been evaluated since well before this version; what
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@discretion/core",
|
|
3
|
-
"version": "0.1.
|
|
3
|
+
"version": "0.1.1",
|
|
4
4
|
"type": "module",
|
|
5
5
|
"description": "Local-first detection and masking of PII, credentials and secrets in text. No network access, no DOM, no Node built-ins.",
|
|
6
6
|
"keywords": [
|
|
@@ -50,7 +50,7 @@
|
|
|
50
50
|
"provenance": true
|
|
51
51
|
},
|
|
52
52
|
"dependencies": {
|
|
53
|
-
"@discretion/data": "0.1.
|
|
53
|
+
"@discretion/data": "0.1.1",
|
|
54
54
|
"libphonenumber-js": "^1.13.11"
|
|
55
55
|
},
|
|
56
56
|
"peerDependencies": {
|