@mano8/astro-media-m8 2.3.0 → 2.3.1

package/CHANGELOG.md

@@ -11,6 +11,49 @@ service line, so the contract can move without moving the major.
 
 ## [Unreleased]
 
+## [2.3.1] - 2026-09-26 · tracks media-service 3.0.2
+
+**Patch.** Tracks the published `@mano8/astro-ui-m8` `1.5.2` and
+`@mano8/astro-auth-m8` `2.7.1` (`B39-astro-ui-changelog-release`, finding
+`G38`). The only shipped change is `package.json`'s floors, with the README
+that states them. The contract stays `media-service-m8@1.1`, range
+`>=2.0.0 <4.0.0`, and the tested service version stays `3.0.2`.
+
+### Added
+
+- **A lock that does not pin every package fails the build**
+  (`B34-npm-lock-integrity-guard`, finding `G34`(b)).
+  `scripts/verify-lock-integrity.mjs` (`npm run verify:lock-integrity`)
+  refuses a `package-lock.json` below `lockfileVersion` 3, or one with any
+  entry that lacks `integrity` or `resolved`, carries a non-`sha512` hash,
+  resolves outside `https://registry.npmjs.org/`, or is a link or `file:`
+  source, and names every offending key. `npm ci` installs an entry with no
+  `integrity` without checking a hash and says nothing, which is how `G33`
+  went unseen. CI runs it before `npm ci` in every job that installs.
+  `tests/lock-integrity.test.ts` proves each refusal against a fixture lock
+  and asserts this repository's own lock passes. The script is
+  dependency-free and byte-identical in the fleet's six npm repositories.
+  This lock already passed; the fixtures prove the red path. Only
+  `package.json`'s `scripts` gains an entry, so no release is owed.
+
+### Changed
+
+- `@mano8/astro-ui-m8` floor `^1.5.1` → `^1.5.2` (`dependencies`) and
+  `@mano8/astro-auth-m8` `^2.7.0` → `^2.7.1` (`peerDependencies` and
+  `devDependencies`, still equal), the newest published releases (§0.5's
+  explicit-pin rule). The lock moves those two entries, each with its
+  registry `resolved` and `sha512` `integrity`. The README states the new
+  floors.
+
+### Security
+
+- **The publish job verifies the lock before it installs**
+  (`B37-publish-lock-guard`, finding `G36`). `B34` guarded every `CI.yaml`
+  job but not the one that holds `id-token: write` and builds the tarball,
+  and the environment's `tag:v*` rule matches a tag by name, not by where it
+  points. `npm-publish.yml` now runs `npm run verify:lock-integrity` before
+  `npm ci`, and `tests/publish-workflow.test.ts` holds the order.
+
 ## [2.3.0] - 2026-09-26 · tracks media-service 3.0.2
 
 **Minor bump.** Tracks the published `media-service-m8` `3.0.2` patch release

package/README.md

@@ -65,12 +65,12 @@ elsewhere.
 npm i @mano8/astro-media-m8 @mano8/astro-auth-m8 zod
 ```
 
-`@mano8/astro-auth-m8` is a required peer at **`^2.7.0` or newer**:
+`@mano8/astro-auth-m8` is a required peer at **`^2.7.1` or newer**:
 `media-service-m8` only accepts `fa-auth-m8`-issued tokens, so the plugin's auth
 adapter must be backed by `fa-auth-m8` (the official plugin, or a custom adapter
 that obtains those tokens). A 1.x auth is not supported — upgrade auth first, or
 the install resolves nothing that satisfies the peer.
-`@mano8/astro-ui-m8` (`^1.5.1`) is a normal dependency because the media registry
+`@mano8/astro-ui-m8` (`^1.5.2`) is a normal dependency because the media registry
 skins compose the canonical shared table from its packaged registry output.
 `react`/`react-dom` are optional — only `./react`, `./hooks` and the starter
 views need them; `@tanstack/react-query` is a required peer once you use

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mano8/astro-media-m8",
-  "version": "2.3.0",
+  "version": "2.3.1",
   "description": "Astro integration and headless client for media-service-m8.",
   "type": "module",
   "license": "MIT",
@@ -57,6 +57,7 @@
     "preview:dev": "vite --config fixtures/preview/vite.config.ts",
     "preview:build": "tsc -p fixtures/preview/tsconfig.json --noEmit && vite build --config fixtures/preview/vite.config.ts",
     "verify:fleet-gates": "node scripts/verify-fleet-gates.mjs",
+    "verify:lock-integrity": "node scripts/verify-lock-integrity.mjs",
     "verify:registry-consumer": "node scripts/verify-registry-consumer.mjs",
     "verify:registry-drift": "node scripts/verify-registry-drift.mjs",
     "verify:starter-routes": "node scripts/verify-starter-routes.mjs",
@@ -67,12 +68,12 @@
     "test:unit": "vitest run"
   },
   "dependencies": {
-    "@mano8/astro-ui-m8": "^1.5.1"
+    "@mano8/astro-ui-m8": "^1.5.2"
   },
   "peerDependencies": {
     "@astrojs/react": "^6.0.1",
     "@astrojs/starlight": "^0.41.3",
-    "@mano8/astro-auth-m8": "^2.7.0",
+    "@mano8/astro-auth-m8": "^2.7.1",
     "@tanstack/react-query": "^5.102.8",
     "astro": "^7.0.9",
     "react": "^18.0.0 || ^19.0.0",
@@ -92,7 +93,7 @@
     "@astrojs/starlight": "^0.41.10",
     "@eslint-react/eslint-plugin": "^5.18.6",
     "@eslint/js": "^10.0.1",
-    "@mano8/astro-auth-m8": "^2.7.0",
+    "@mano8/astro-auth-m8": "^2.7.1",
     "@tanstack/react-query": "^5.102.8",
     "@tanstack/react-table": "^8.21.3",
     "@types/node": "^26.4.0",