@ipation/specbridge 1.1.0 → 1.1.2

package/CHANGELOG.md

@@ -7,6 +7,71 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.1.2] - 2026-02-02
+
+### Documentation
+
+#### Dogfooding Expansion
+
+- **📚 Expanded Architectural Decisions** - Added 10 new decision files
+  - `arch-006`: Verifier Plugin Architecture - Base interface and registry pattern
+  - `arch-007`: Security Pattern Enforcement - ReDoS, XSS, SQL injection prevention
+  - `arch-008`: Autofix TextEdit Offset Model - 0-based byte offsets with descending sort
+  - `arch-009`: Server Integration Options Pattern - LSP/MCP lazy initialization
+  - `arch-010`: Configuration Merging Strategy - Recursive merge for nested objects
+  - `arch-011`: Testing Infrastructure Standards - Vitest with 90%+ coverage thresholds
+  - `arch-012`: Scope Matching Logic - Centralized applicability checking
+  - `arch-013`: Agent Context Format Conventions - Emoji icons and multiple formats
+  - `arch-014`: Violation Model Structure - createViolation helper usage
+  - `arch-015`: Verifier Extension Stability - API stability guarantees
+
+- **📊 Compliance Achievement**
+  - Expanded dogfooding from 5 to 15 active architectural decisions
+  - 54 total constraints (up from 7)
+  - 100% compliance across codebase
+  - Documents all patterns introduced in v1.1.0
+
+- **📖 Updated Documentation**
+  - Updated `docs/dogfooding-guide.md` with all 15 decisions
+  - Updated integration tests to verify all 15 decisions
+  - Comprehensive decision coverage for verifiers, security, autofix, servers, and testing
+
+### Testing
+
+- ✅ All 893 tests passing
+- ✅ Commit-level verification < 5 seconds
+- ✅ 100% architectural compliance
+
+## [1.1.1] - 2026-02-01
+
+### Security
+
+#### Fixed Vulnerabilities
+
+- **🔒 Polynomial ReDoS (3 instances)** - `src/verification/verifiers/dependencies.ts`
+  - Fixed unbounded regex quantifiers in `parseMaxImportDepth()`, `parseBannedDependency()`, `parseLayerRule()`
+  - Changed `\s+` to bounded `\s{1,5}` to prevent catastrophic backtracking
+  - Prevents denial-of-service attacks via malicious input strings
+  - Resolves GitHub CodeQL alerts #7, #8, #9
+
+- **🔒 Incomplete Sanitization** - `src/integrations/github.ts`
+  - Enhanced markdown escaping to cover all special characters
+  - Now escapes: backslash, pipe, brackets, asterisk, underscore, backtick
+  - Prevents markdown table breaking and potential injection
+  - Resolves GitHub CodeQL alert #6
+
+- **🔒 Shell Command Injection (3 instances)** - `tests/integration/dogfooding.test.ts`
+  - Replaced `execSync` with `execFileSync` for safer command execution
+  - Uses array form for arguments to prevent shell interpretation
+  - Eliminates risk of command injection in test environment
+  - Resolves GitHub CodeQL alerts #3, #4, #5
+
+### Testing
+
+- ✅ All 893 tests passing
+- ✅ No functional regressions
+- ✅ Test coverage maintained at 92%+
+
 ## [1.1.0] - 2026-02-01
 
 ### 🚀 Major Feature Release
@@ -641,7 +706,8 @@ This release adopts a **pragmatic testing approach**:
 - Vitest for testing
 - tsup for building
 
-[Unreleased]: https://github.com/nouatzi/specbridge/compare/v1.1.0...HEAD
+[Unreleased]: https://github.com/nouatzi/specbridge/compare/v1.1.1...HEAD
+[1.1.1]: https://github.com/nouatzi/specbridge/compare/v1.1.0...v1.1.1
 [1.1.0]: https://github.com/nouatzi/specbridge/compare/v1.0.6...v1.1.0
 [1.0.0]: https://github.com/nouatzi/specbridge/compare/v0.2.1...v1.0.0
 [0.2.1]: https://github.com/nouatzi/specbridge/compare/v0.2.0...v0.2.1

package/dist/cli.js

@@ -2190,17 +2190,17 @@ function tarjanScc(graph) {
   return result;
 }
 function parseMaxImportDepth(rule) {
-  const m = rule.match(/maximum\s+import\s+depth\s*[:=]?\s*(\d+)/i);
+  const m = rule.match(/maximum\s{1,5}import\s{1,5}depth\s{0,5}[:=]?\s{0,5}(\d+)/i);
   return m ? Number.parseInt(m[1], 10) : null;
 }
 function parseBannedDependency(rule) {
-  const m = rule.match(/no\s+dependencies?\s+on\s+(?:package\s+)?(.+?)(?:\.|$)/i);
+  const m = rule.match(/no\s{1,5}dependencies?\s{1,5}on\s{1,5}(?:package\s{1,5})?(.+?)(?:\.|$)/i);
   if (!m) return null;
   const value = m[1].trim();
   return value.length > 0 ? value : null;
 }
 function parseLayerRule(rule) {
-  const m = rule.match(/(\w+)\s+layer\s+cannot\s+depend\s+on\s+(\w+)\s+layer/i);
+  const m = rule.match(/(\w+)\s{1,5}layer\s{1,5}cannot\s{1,5}depend\s{1,5}on\s{1,5}(\w+)\s{1,5}layer/i);
   if (!m) return null;
   return { fromLayer: m[1].toLowerCase(), toLayer: m[2].toLowerCase() };
 }