@js-recon/js-recon 2.0.1-alpha.3 → 2.0.1-beta.1

package/.github/workflows/build-and-prettify.yaml

@@ -15,7 +15,9 @@ jobs:
       !startsWith(github.event.head_commit.message, 'chore: prettify code')
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Check version mismatch
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -45,8 +47,10 @@ jobs:
     runs-on: ubuntu-latest
     needs: version_check
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "22"
           cache: "npm"
@@ -63,7 +67,7 @@ jobs:
       contents: write
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # Make sure the action checks out the repository to the pull request branch
           ref: ${{ github.ref_name }}
@@ -76,7 +80,7 @@ jobs:
           commit-email: ${{ secrets.JS_RECON_SIGNING_EMAIL }}
 
       - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "22"
           cache: "npm"
@@ -104,12 +108,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          persist-credentials: false
           ref: ${{ github.ref_name }}
 
       - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "22"
           cache: "npm"
@@ -125,12 +130,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          persist-credentials: false
           ref: ${{ github.ref_name }}
 
       - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "22"
           cache: "npm"
@@ -146,13 +152,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          persist-credentials: false
           # Make sure the action checks out the repository to the pull request branch
           ref: ${{ github.ref_name }}
 
       - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "22"
           cache: "npm"
@@ -167,8 +174,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          persist-credentials: false
           # Make sure the action checks out the repository to the pull request branch
           ref: ${{ github.ref_name }}
       - name: Build docker container
@@ -180,13 +188,15 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout js-recon
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          persist-credentials: false
           ref: ${{ github.ref_name }}
 
       - name: Checkout js-recon-labs
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          persist-credentials: false
           repository: js-recon/js-recon-labs
           path: js-recon-labs
 
@@ -202,7 +212,7 @@ jobs:
           git clone --depth 1 --branch "$BRANCH" https://github.com/js-recon/js-recon-rules.git js-recon-rules
 
       - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "22"
           cache: "npm"
@@ -250,7 +260,7 @@ jobs:
 
       - name: Upload analyze.json on failure
         if: failure()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: analyze-json-docker
           path: output/**/analyze.json
@@ -284,7 +294,7 @@ jobs:
 
       - name: Upload w-rules analyze.json on failure
         if: failure()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: analyze-json-docker-w-rules
           path: output-w-rules/**/analyze.json
@@ -296,13 +306,15 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout js-recon
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          persist-credentials: false
           ref: ${{ github.ref_name }}
 
       - name: Checkout js-recon-labs
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          persist-credentials: false
           repository: js-recon/js-recon-labs
           path: js-recon-labs
 
@@ -318,7 +330,7 @@ jobs:
           git clone --depth 1 --branch "$BRANCH" https://github.com/js-recon/js-recon-rules.git js-recon-rules
 
       - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "22"
           cache: "npm"
@@ -377,7 +389,7 @@ jobs:
 
       - name: Upload analyze.json on failure
         if: failure()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: analyze-json-macos
           path: output/**/analyze.json

package/.github/workflows/codeql.yml

@@ -20,14 +20,16 @@ jobs:
     name: Analyze (javascript-typescript)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+        uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
         with:
           languages: javascript-typescript
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+        uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
         with:
           category: "/language:javascript-typescript"

package/.github/workflows/exploit-smoke-test.yaml

@@ -15,16 +15,19 @@ jobs:
 
     steps:
       - name: Checkout js-recon
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Checkout js-recon-labs
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          persist-credentials: false
           repository: js-recon/js-recon-labs
           path: js-recon-labs
 
       - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "22"
           cache: "npm"
@@ -38,7 +41,7 @@ jobs:
       # --- Next.js: CVE-2025-29927 (middleware bypass) ---
       - name: Build cve-2025-29927 fixture
         working-directory: js-recon-labs/next_js/cve-2025-29927
-        run: npm install && npm run build
+        run: npm ci && npm run build
 
       - name: Start cve-2025-29927 fixture
         working-directory: js-recon-labs/next_js/cve-2025-29927
@@ -47,7 +50,7 @@ jobs:
       # --- Next.js: CVE-2026-64645 (rewrites SSRF) ---
       - name: Build cve-2026-64645 fixture
         working-directory: js-recon-labs/next_js/cve-2026-64645
-        run: npm install && npm run build
+        run: npm ci && npm run build
 
       - name: Start cve-2026-64645 fixture
         working-directory: js-recon-labs/next_js/cve-2026-64645
@@ -56,7 +59,7 @@ jobs:
       # --- Next.js: CVE-2025-55182 (React Flight RCE) ---
       - name: Install cve-2025-55182 fixture dependencies
         working-directory: js-recon-labs/next_js/cve-2025-55182
-        run: npm install
+        run: npm ci
 
       - name: Start cve-2025-55182 fixture
         working-directory: js-recon-labs/next_js/cve-2025-55182
@@ -65,7 +68,7 @@ jobs:
       # --- Vite: CVE-2025-30208 (fs.deny double-'?' bypass) ---
       - name: Install cve-2025-30208 fixture dependencies
         working-directory: js-recon-labs/vite/cve-2025-30208
-        run: npm install
+        run: npm ci
 
       - name: Start cve-2025-30208 fixture
         working-directory: js-recon-labs/vite/cve-2025-30208
@@ -74,7 +77,7 @@ jobs:
       # --- Vite: CVE-2026-39363 (WebSocket fetchModule bypass) ---
       - name: Install cve-2026-39363 fixture dependencies
         working-directory: js-recon-labs/vite/cve-2026-39363
-        run: npm install
+        run: npm ci
 
       - name: Start cve-2026-39363 fixture
         working-directory: js-recon-labs/vite/cve-2026-39363
@@ -83,7 +86,7 @@ jobs:
       # --- Nuxt: CVE-2026-71320 (Server Island RCE) ---
       - name: Build cve-2026-71320 fixture
         working-directory: js-recon-labs/nuxt/cve-2026-71320
-        run: npm install && npm run build
+        run: npm ci && npm run build
 
       - name: Start cve-2026-71320 fixture
         working-directory: js-recon-labs/nuxt/cve-2026-71320
@@ -92,7 +95,7 @@ jobs:
       # --- Nuxt: CVE-2026-71315 (route-rule casing bypass) ---
       - name: Build cve-2026-71315 fixture
         working-directory: js-recon-labs/nuxt/cve-2026-71315
-        run: npm install && npm run build
+        run: npm ci && npm run build
 
       - name: Start cve-2026-71315 fixture
         working-directory: js-recon-labs/nuxt/cve-2026-71315
@@ -101,7 +104,7 @@ jobs:
       # --- Angular: CVE-2026-68945 (HttpTransferCache collision) ---
       - name: Build cve-2026-68945 fixture
         working-directory: js-recon-labs/angular/cve-2026-68945
-        run: npm install && npm run build
+        run: npm ci && npm run build
 
       - name: Start cve-2026-68945 fixture
         working-directory: js-recon-labs/angular/cve-2026-68945
@@ -153,7 +156,7 @@ jobs:
 
       - name: Upload exploit results on failure
         if: failure()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: exploit-results
           path: /tmp/exploit-results/**

package/.github/workflows/framework-detection-smoke-test.yaml

@@ -23,16 +23,19 @@ jobs:
 
     steps:
       - name: Checkout js-recon
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Checkout js-recon-labs
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          persist-credentials: false
           repository: js-recon/js-recon-labs
           path: js-recon-labs
 
       - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "22"
 
@@ -128,7 +131,7 @@ jobs:
 
       - name: Upload fingerprint result on failure
         if: failure()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: fingerprint-result
           path: /tmp/fingerprint-result.json

package/.github/workflows/plumber.yml

@@ -14,7 +14,9 @@ jobs:
   plumber:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - uses: getplumber/plumber@ef9864df81f444647d95889d98695434f6fa9732 # v0.4.12, 2026-07-20
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: getplumber/plumber@e81ed4965fd92e0d2b63e95d399ed0419f5de2fa # v0.4.12, 2026-07-20
         with:
           score-push: true

package/.github/workflows/pr_checker.yml

@@ -11,7 +11,9 @@ jobs:
     permissions:
       pull-requests: write
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Redirect PR to dev
         if: github.head_ref != 'dev' || github.event.pull_request.head.repo.full_name != 'js-recon/js-recon'
         env:

package/.github/workflows/promote-js-recon.yml

@@ -45,7 +45,7 @@ jobs:
           VERSION: ${{ inputs.version }}
 
       - name: Check out homebrew-tap
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: js-recon/homebrew-tap
           token: ${{ secrets.HOMEBREW_TAP_GH_PAT }}
@@ -85,9 +85,11 @@ jobs:
       contents: read
       packages: write
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Checkout js-recon-rules
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: js-recon/js-recon-rules
           path: js-recon-rules
@@ -95,7 +97,7 @@ jobs:
           # Dockerfile.w-rules builds from this context and would otherwise bake
           # the writable GHCR credential into an image layer.
           persist-credentials: false
-      - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -142,13 +144,13 @@ jobs:
       contents: read
     steps:
       - name: Checkout js-recon-labs
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: js-recon/js-recon-labs
           path: js-recon-labs
           persist-credentials: false
 
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "22"
 
@@ -195,17 +197,17 @@ jobs:
       packages: read
     steps:
       - name: Checkout js-recon-labs
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: js-recon/js-recon-labs
           path: js-recon-labs
           persist-credentials: false
 
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "22"
 
-      - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -260,20 +262,22 @@ jobs:
       packages: read
     steps:
       - name: Checkout js-recon
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Checkout js-recon-labs
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: js-recon/js-recon-labs
           path: js-recon-labs
           persist-credentials: false
 
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "22"
 
-      - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -329,14 +333,14 @@ jobs:
         formula: [js-recon, js-recon-alpha, js-recon-beta]
     steps:
       - name: Checkout js-recon-labs
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: js-recon/js-recon-labs
           path: js-recon-labs
           persist-credentials: false
 
       - name: Checkout js-recon-rules
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: js-recon/js-recon-rules
           path: js-recon-rules

package/.github/workflows/publish-js-recon.yml

@@ -14,7 +14,7 @@ jobs:
   version_check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Check version mismatch
         run: |
           echo "[i] Checking if the version in the CHANGELOG.md, package.json, and Github release version matches"
@@ -42,8 +42,8 @@ jobs:
     needs: version_check
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22
       - run: npm ci
@@ -54,8 +54,8 @@ jobs:
     needs: audit
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22
       - run: npm ci
@@ -66,7 +66,7 @@ jobs:
     needs: build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Download and verify depx (SHA256-pinned)
         run: |
           set -euo pipefail
@@ -94,8 +94,8 @@ jobs:
       id-token: write
       contents: read
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22
           registry-url: https://registry.npmjs.org/
@@ -120,7 +120,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
       - name: Configure SSH commit signing

package/.github/workflows/rules-smoke-test.yaml

@@ -15,11 +15,14 @@ jobs:
 
     steps:
       - name: Checkout js-recon
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Checkout js-recon-labs
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          persist-credentials: false
           repository: js-recon/js-recon-labs
           path: js-recon-labs
 
@@ -35,7 +38,7 @@ jobs:
           git clone --depth 1 --branch "$BRANCH" https://github.com/js-recon/js-recon-rules.git js-recon-rules
 
       - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "22"
           cache: "npm"
@@ -80,7 +83,7 @@ jobs:
 
       - name: Upload analyze.json on failure
         if: failure()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: analyze-json
           path: output/**/analyze.json

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # Change Log
 
+## 2.0.1-beta.1 - 2026-08-17
+
+### Added
+
+- New `nuxt-dev` tech: detects a Nuxt.js dev server (`nuxi dev` / `npm run dev`) as a distinct tech from a production `nuxt` build, mirroring `next-dev`/`vue-dev`/`svelte-dev`/`react-dev`/`angular-dev` (#194). Nuxt 3/4 (Vite) and Nuxt 2 (webpack) dev-server markers were **both** confirmed live this round — unlike several sibling `*-dev` webpack branches. `checkNuxtDevServer.ts` looks for Nuxt's own `/_nuxt/`-prefixed Vite client path (`/_nuxt/@vite/client`, distinct from vanilla Vite's root `/@vite/client`) plus a weak `__NUXT_DEVTOOLS_TIME_METRIC__` inline-script signal for Nuxt 3/4, and an unhashed `_nuxt/app.js` entry filename plus a `/__webpack_hmr` intercepted-request pathname for Nuxt 2. The gate is checked only after `checkNuxtJS` matches, at both the HTML-level check and the intercepted-URL fallback. No dedicated crawler was needed — the existing `nuxt_js/*` pipeline already handles dev mode once two shared (not dev-specific) bugs were fixed: `nuxt_stringAnalysisJSFiles.ts`'s literal-path scanner previously matched only a bare `.js` suffix, missing every cache-busted (`?v=<hash>`) Vite import and every raw `.mjs`/`.ts`/`.vue` dev-mode source reference; and a malformed/oversized literal (e.g. an entire module's source embedded in a webpack `eval`-devtool string) could throw inside the per-file resolver and permanently block that file from ever being marked analyzed, spinning the discovery loop forever. A third, general bug (affecting every `*-dev` webpack branch, not just Nuxt's) was also fixed: `techDetect/index.ts` no longer reads the full response body of an intercepted `text/event-stream` connection (e.g. a webpack-hot-middleware HMR socket), which previously hung tech detection indefinitely against any webpack dev server with an open HMR connection. `run`'s tech allow-list and pipeline condition were extended accordingly (Nuxt's map/analyze calls already hardcode `"vue"` regardless of dev/prod, so no new remap arm was needed). Benchmarked at effectively complete recovery for both Nuxt generations against an independent `katana` crawl (Nuxt 3: 176/177 URLs, the one miss being a Vite-internal-only file never fetched as app content; Nuxt 2: 0 missed, full overlap) and cross-checked with a `jsr-network-bench` dual-capture pass showing zero real discovery gaps. (`lazyload`, `run`)
+
+### Fixed
+
+- `run`'s generated OpenAPI spec and Postman collection now use the actual target URL instead of a placeholder: `openapiGenerator.ts`'s `servers[].url` and `postmanGenerator.ts`'s `baseUrl` variable read a new `targetUrl` global (`src/utility/globals.ts`), set from the `-u` value at the start of `processUrl`, falling back to the previous `{{baseUrl}}`/`https://example.com` placeholder if unset. `setTargetUrl` strips `username`/`password`/`search`/`hash` before storing, so a `-u` value carrying basic-auth credentials or a signed query token doesn't leak into the generated artifacts. (`run`, `openapi`, `postman`)
+- Nuxt 2 dev-server detection (`checkNuxtDevServer.ts`) no longer misclassifies a production build as `nuxt-dev`: the unhashed-entry marker now requires the full `/_nuxt/app.js` suffix (was matching any `app.js` basename, e.g. `/assets/app.js`), and the webpack-HMR marker requires a complete `__webpack_hmr` path segment instead of a bare substring match.
+- `techDetect/index.ts`'s event-stream content-type check is now case-insensitive, so a server returning `Text/Event-Stream; charset=utf-8` (mixed case, with parameters) still gets skipped instead of hanging tech detection on that persistent HMR connection.
+- `refactor -t react-webpack`'s webpack-async-chunk-loading rewrite (`requireParam.e(N).then(requireParam.bind(requireParam, N))` → dynamic import) now emits a real `ImportExpression` node (`t.importExpression`) instead of a `CallExpression` with an `Import`-type callee — the latter is Babel 7's legacy shape and is no longer a valid expression under the `@babel/types` v8 migrated in this same release, which silently broke `renameRouteComponents`' route-component renaming for any React-Router lazy route using this webpack pattern.
+- AI SDK clients (`src/utility/ai.ts`) are now constructed lazily on first use instead of at module load. The `openai` dependency's v7 line changed its `OpenAI` client constructor to throw immediately when no `apiKey` is configured, which crashed **every** js-recon invocation on import — not just runs that actually use an AI feature (`mcp`'s AI chat, `analyze`'s AI-assisted rule helpers) — for any user who hadn't set an AI API key. The OpenAI, Ollama, and Anthropic clients are now held behind `??=`-memoized getters and only instantiated the first time `ai()` resolves a provider, so an unconfigured AI provider is inert until actually selected. (`ai`)
+- Migrated `@babel/types`, `@babel/parser`, and `@babel/traverse` from v7 to v8 (`^8.0.4`), dropping the now-stale `@types/babel__traverse` pin that was shipping a duplicate nested v7 type copy. Beyond the mechanical fallout of v8 dropping default exports (namespace imports) and no longer CJS-interop-wrapping `traverse`/`generator` (removing the `(_x.default ?? _x)` unwrap pattern) across roughly 120 call sites, the upgrade carried one real functional risk that was caught and fixed in the same change: v8's parser now emits a dynamic `import(...)` call as an `ImportExpression` node directly, rather than the v7 shape (a `CallExpression` with an `Import`-type callee). Four dynamic-import detection call sites still checked for the old shape — `angular_recursiveChunkImports.ts`, `vue_jsImports.ts`, `react-vite`'s and `refactor/react/transform.ts`'s import-rewriting — and would have silently stopped matching any dynamic import in every affected pipeline had they not been updated to also recognize `ImportExpression`. Verified with a clean `tsc` build, the full unit suite, an end-to-end `run` against local targets, and a `refactor -t react-webpack` pass against a real code-split React bundle. (`lazyload`, `map`, `analyze`, `refactor`, `endpoints`, `strings`)
+
+### Security
+
+- CI workflow checkouts that don't perform an authenticated git operation (`codeql.yml`, `plumber.yml`, `pr_checker.yml`, the smoke-test workflows, most jobs in `build-and-prettify.yaml`/`promote-js-recon.yml`) now set `persist-credentials: false`, so the ambient `GITHUB_TOKEN` isn't left in `.git/config` for later steps or third-party actions in that job to read.
+
+### Fixed
+
+- `@babel/generator` (imported directly by `map`'s `esquery` interactive command) is now declared as a direct `dependencies` entry instead of only being present transitively via `@babel/traverse`/`@babel/core`.
+
 ## 2.0.1-alpha.3 - 2026-08-14
 
 ### Added

package/Dockerfile

@@ -1,4 +1,4 @@
-FROM ghcr.io/puppeteer/puppeteer:24.43.1
+FROM ghcr.io/puppeteer/puppeteer:25.8.0
 
 WORKDIR /home/pptruser
 # Pin HOME so path resolution (Puppeteer's Chrome cache, ~/.js-recon rules cache, etc.)

package/Dockerfile.release

@@ -1,4 +1,4 @@
-FROM ghcr.io/puppeteer/puppeteer:25.3.0
+FROM ghcr.io/puppeteer/puppeteer:25.8.0
 
 WORKDIR /home/pptruser
 # Pin HOME so path resolution (Puppeteer's Chrome cache, ~/.js-recon rules cache, etc.)

package/build/analyze/engine/astEngine.js

@@ -7,11 +7,9 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         step((generator = generator.apply(thisArg, _arguments || [])).next());
     });
 };
-import parser from "@babel/parser";
-import _traverse from "@babel/traverse";
-import _generator from "@babel/generator";
-const _traverseDefault = _traverse.default;
-const generator = _generator.default;
+import * as parser from "@babel/parser";
+import _traverseDefault from "@babel/traverse";
+import generator from "@babel/generator";
 import esquery from "esquery";
 import { highlight } from "cli-highlight";
 import { resolveFunctionIdentifier } from "../helpers/engineHelpers/resolveFunctionIdentifier.js";