@massu/core 2.5.3 → 2.5.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +23 -0
- package/docs/SECURITY.md +1 -1
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -10,6 +10,29 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
|
|
|
10
10
|
> redistributed under the **Apache License 2.0**. Full license + NOTICE:
|
|
11
11
|
> `packages/core/assets/embedder/MODEL-LICENSE`.
|
|
12
12
|
|
|
13
|
+
## [2.5.4] - 2026-11-08
|
|
14
|
+
|
|
15
|
+
### Fixed
|
|
16
|
+
|
|
17
|
+
- **Release tooling no longer reports a successful publish as failed.** After `npm publish`
|
|
18
|
+
succeeded, the release verifier waited 90 seconds, then reported FAIL with "this is not
|
|
19
|
+
propagation lag". npm's registry can take a few minutes to serve a new version. The verifier
|
|
20
|
+
now has three results. PASS: the version is served and the package carries the fix. PENDING:
|
|
21
|
+
npm accepted the publish but isn't serving it yet; re-run `--verify-only`, don't publish again.
|
|
22
|
+
FAIL: npm refused the publish, or the served package is wrong.
|
|
23
|
+
- **Publishing no longer leaves uncommitted changes.** The four bundled-public-key modules
|
|
24
|
+
stamped the current time into their first line, so every publish rewrote four tracked files
|
|
25
|
+
whose keys hadn't changed. One shared, deterministic generator replaces the four hand-copied
|
|
26
|
+
ones, and a test confirms each committed module matches what the generator renders.
|
|
27
|
+
- **The public repository carries release tags again.** Every mirror sync now tags the public
|
|
28
|
+
commit that holds a release's exact tree, verifies the tag on GitHub, and never moves an
|
|
29
|
+
existing tag. This release backfills v2.0.0, v2.3.0 and v2.5.3.
|
|
30
|
+
- **The public repository's six `nx` security alerts are cleared.** They came from two test
|
|
31
|
+
fixtures that declared `nx ^17.0.0`. Nothing installs either fixture; both now declare
|
|
32
|
+
`^22.7.10`.
|
|
33
|
+
|
|
34
|
+
`@massu/core` behaves exactly as 2.5.3 did: every change is in release tooling and test fixtures.
|
|
35
|
+
|
|
13
36
|
## [2.5.3] - 2026-11-08
|
|
14
37
|
|
|
15
38
|
### Added
|
package/docs/SECURITY.md
CHANGED
|
@@ -114,7 +114,7 @@ Rotation procedure:
|
|
|
114
114
|
3. Append the new RAW-bytes sha256 to `KNOWN_PUBKEY_FINGERPRINTS` in
|
|
115
115
|
`scripts/bundle-pubkey.mjs` (DO NOT remove the old entry — rotation
|
|
116
116
|
grace window).
|
|
117
|
-
4. Run `
|
|
117
|
+
4. Run `node scripts/bundle-pubkey.mjs` to regenerate
|
|
118
118
|
`packages/core/src/security/registry-pubkey.generated.ts`.
|
|
119
119
|
5. Sign a transition manifest **countersigned by both old AND new keys**
|
|
120
120
|
so consumers running pre-rotation `@massu/core` can still verify
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@massu/core",
|
|
3
|
-
"version": "2.5.
|
|
3
|
+
"version": "2.5.4",
|
|
4
4
|
"type": "module",
|
|
5
5
|
"description": "AI Engineering Governance MCP Server - Session memory, knowledge system, feature registry, code intelligence, rule enforcement, tiered tooling (12 free / 73 total), 56 workflow commands, 11 agents, 20+ patterns",
|
|
6
6
|
"main": "./dist/cli.js",
|