@holmes-lab/holmes-kit 0.19.5 → 0.19.6

package/CHANGELOG.md

@@ -5,11 +5,50 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 <!-- @implements A-SPEC-209 -->
+## [0.19.6] - 2026-09-11
+
+A correction. 0.19.5 claimed a security improvement that does not reach the people it was written
+for, and a claim that does not hold is worse than no claim.
+
+### Fixed
+- **The `protobufjs` override does not protect consumers, and 0.19.5 said it did.** `overrides` is a
+  ROOT-manifest field: npm applies it from the top-level project only and ignores a dependency's.
+  The field ships inside this package's `package.json` and has no effect there. Measured against the
+  published 0.19.5 from a fresh consumer project: `protobufjs@6.11.6`, critical 1 / high 5 —
+  unchanged. This repository had already recorded that `allowScripts` is root-only and does not
+  transfer; the same property of `overrides` was not carried across, and the claim was written before
+  a third-party install was checked.
+
+  The override is kept, because it does protect this repository's own tree — development, CI and the
+  release gate. What changed is the description.
+
+### Security
+- **Consumers who want the critical advisory gone must declare the override themselves.** In the
+  CONSUMING project's `package.json`:
+
+  ```json
+  { "overrides": { "protobufjs": "^7.6.3" } }
+  ```
+
+  Measured from a fresh consumer project: `protobufjs@7.6.6`, **critical 0 / high 3**, with the
+  local model's real inference intact. The remaining three highs (`@xenova/transformers`, `js-yaml`,
+  `sharp`) are unaffected by this and stay recorded, with their re-evaluation triggers, in
+  `docs/goals/supply-chain-xenova-2026-09.md`. The durable fix is upstream — an
+  `@xenova/transformers` line that does not pull `onnxruntime-web`'s 6.x `protobufjs` — and is not
+  something this package can deliver on a consumer's behalf.
+
 ## [0.19.5] - 2026-09-11
 
 One critical supply-chain advisory removed, by measuring a prediction this project had written down
 and found to be wrong.
 
+> **Correction (0.19.6):** the entry below overstates its reach. `overrides` is a ROOT-manifest
+> field — npm applies it only from the top-level project, never from a dependency — so installing
+> this package does **not** change what a consumer resolves. Measured on the published 0.19.5:
+> a consumer still gets `protobufjs@6.11.6`, critical 1 / high 5. The override protects THIS
+> repository's tree (development, CI, the release gate) and nothing else. A consumer who wants it
+> must declare it themselves; see the Security note in 0.19.6.
+
 ### Security
 - **`protobufjs` is overridden to 7.x, and the critical advisory is gone** (REQ-601). The arbitrary
   code execution lives in protobufjs's 6.x line, reached three levels down —

package/README.md

@@ -165,6 +165,15 @@ To prepare during installation instead, set `HOLMES_AUTO_MODEL_INSTALL=1` before
 is never overridden. Models live in `~/.holmes/models` (`%USERPROFILE%\.holmes\models` on Windows);
 `HOLMES_MODEL_CACHE` overrides that, including for a prepopulated offline cache.
 
+> **Security note.** This package's dependency chain pulls `protobufjs@6.x` through
+> `@xenova/transformers → onnxruntime-web → onnx-proto`, which carries a critical advisory. npm's
+> `overrides` is a ROOT-manifest field, so we cannot fix this on your behalf — declare it in YOUR
+> `package.json` to resolve it:
+> ```json
+> { "overrides": { "protobufjs": "^7.6.3" } }
+> ```
+> Measured from a fresh install: `critical 1 → 0`, `high 5 → 3`, with local inference intact.
+
 > On **ARM Linux**, install with Node 20 or 22: `tree-sitter@0.21.1` ships no `linux-arm64` prebuild,
 > so it compiles from source, and that compile fails against Node 24 headers. The failure happens
 > while npm is still installing dependencies — before Holmes-Kit exists — so `doctor` cannot diagnose

package/dist/.build-id

@@ -1 +1 @@
-5efeb5b9-mtx1x7js
+b6de96c3-mtx2uyhs

package/package.json

@@ -1,7 +1,7 @@
 {
   "//": "@implements A-SPEC-209",
   "name": "@holmes-lab/holmes-kit",
-  "version": "0.19.5",
+  "version": "0.19.6",
   "description": "Holmes-Kit — deterministic Agentic Software Engineering (ASE) harness with causal traceability (spec chain + D-CPG + RTM + phase guardrail)",
   "main": "dist/holmes/mcp/server.js",
   "types": "dist/holmes/mcp/server.d.ts",