@openlup/core 0.23.0 → 0.24.0

package/CHANGELOG.md

@@ -10,6 +10,23 @@ in the source repository.
 
 ## [Unreleased]
 
+## [0.24.0]
+
+- Publishable on the npm `latest` dist-tag as `0.24.0`, from tag
+  `openlup-core-v0.24.0`.
+
+- Require Zod `^4.6.6` to fix GHSA-mrhx-c7xc-m3w5; oversized constrained
+  collections fail before element validation accumulates errors. Public exports
+  and accepted bounded inputs are unchanged.
+
+- Republish the remaining APIs, runtime behavior and shipped SQL unchanged from `0.23.0`.
+
+Migration: upgrade the complete set together for exact internal peers; core introduces no API or schema migration. The Zod floor above changes validation of oversized constrained collections.
+
+### Known limitations
+
+The fulfillment status map retains localized adopter labels; hosts still need injected labels or internationalization keys.
+
 ## [0.23.0]
 
 - Publishable on the npm `latest` dist-tag as `0.23.0`, from tag
@@ -39,12 +56,3 @@ no application import or schema migration is required.
 ### Known limitations
 
 - `FULFILLMENT_STATUS_MAP` carries localized adopter labels. Replace them with host-injected labels or internationalization keys before any stable-framework claim.
-
-## [0.21.0]
-
-- Publishable on the npm `latest` dist-tag as `0.21.0`, from tag
-  `openlup-core-v0.21.0`.
-
-- Republish unchanged APIs, runtime behavior and shipped SQL from `0.20.0` as part of the complete `0.21.0` package set.
-
-Migration: upgrade the complete set together; core introduces no API or schema migration in this release.

package/CONTRIBUTING.md

@@ -17,8 +17,13 @@ npm run ci
 
 The gate builds every export, runs standalone tests and isolated package smoke,
 verifies declaration snapshots, and checks license, SBOM, audit, pack, and
-publish controls. Root Vitest excludes this suite; CI's required `install-proof` job runs it separately through the shared package gate,
-independently of the required root `test` job.
+publish controls. Root Vitest excludes this suite. Required `install-proof`
+runs the shared API phase and `ci:required` separately from root tests.
+`ci:required` uses `release:admission`: the same release checks except the full
+live audit, which remains in standalone `ci`, `release:check` and publication.
+Repository admission instead refuses newly selected vulnerable production
+dependencies against the exact base; inherited advisories do not freeze
+unrelated PRs. See [required checks](https://github.com/openlup/openlup/blob/main/CONTRIBUTING.md#required-and-raw-checks).
 
 ## Scope
 

package/README.md

@@ -8,11 +8,18 @@ application" section, which `docs:check` requires, tells an application's agent
 not to edit or patch the installed package and to upgrade every `@openlup/*`
 package together.
 
-The prepared `0.23.0` set republishes core unchanged from `0.22.0`.
-Upgrade all packages together and read [the migration and label limitation](CHANGELOG.md#0230).
-The size baseline is the published `0.22.0` artifact; older releases remain in
+The prepared `0.24.0` set carries the Zod validation floor below; remaining APIs,
+runtime behavior and shipped SQL are unchanged from `0.23.0`.
+Upgrade all packages together and read [the migration and label limitation](CHANGELOG.md#0240).
+The size baseline is the published `0.23.0` artifact; older releases remain in
 the source-only `CHANGELOG-HISTORY.md`. Preparation establishes no npm publication.
 
+The prepared set requires Zod `^4.6.6` for GHSA-mrhx-c7xc-m3w5.
+Oversized constrained collections fail before per-element errors accumulate;
+bounded valid inputs and public exports are preserved. Both dependency locks
+select the fixed runtime. The build uses the existing development-only Node
+types for Zod's standard `URL` declaration; Core adds no runtime Node import.
+
 ## Channel and stability
 
 - **Channel:** npm, on the `latest` dist-tag. Each version is published with
@@ -166,7 +173,11 @@ npm run ci
 Focused proofs are `npm run api:check`, `npm run release:check`, and
 `npm run test:consumer`. The root test script skips this suite.
 The shared repository gate runs this package's API check before expensive
-proofs, then `ci:required` retains the other complete-CI obligations once.
+proofs, then `ci:required` retains the mechanical obligations once through
+`release:admission`. That mode skips only the absolute live dependency audit;
+repository admission checks newly selected vulnerable production dependencies
+against the base instead. Unchanged inherited advisories remain alerts.
+`release:check`, standalone `ci` and publication packs retain the full audit.
 The standalone `ci` command keeps its API check for manual package verification.
 In the monorepo, required CI supplies `OPENLUP_PACK_MANIFEST` and
 `OPENLUP_PACK_COMMIT` together to the same consumer. It verifies the complete

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openlup/core",
-  "version": "0.23.0",
+  "version": "0.24.0",
   "description": "Neutral D2C subscription and bundle commerce kernels; a development preview with no stable API.",
   "license": "Apache-2.0",
   "repository": {
@@ -38,10 +38,11 @@
     "api:check": "node --experimental-strip-types ./scripts/api-contract.ts",
     "api:update": "npm run build && node --experimental-strip-types ./scripts/api-contract.ts --update",
     "ci": "npm run test:coverage && npm run typecheck:smoke && npm run api:check && npm run docs:check && npm run release:check && npm run test:consumer",
-    "ci:required": "npm run test:coverage && npm run typecheck:smoke && npm run docs:check && npm run release:check && npm run test:consumer",
+    "ci:required": "npm run test:coverage && npm run typecheck:smoke && npm run docs:check && npm run release:admission && npm run test:consumer",
     "docs:check": "node --experimental-strip-types ./scripts/documentation-contract.ts",
     "prepack": "npm run build",
     "prepublishOnly": "node --experimental-strip-types ./scripts/refuse-publish.ts",
+    "release:admission": "npm run build && node --experimental-strip-types ./scripts/release-check.ts admission",
     "release:audit": "node --experimental-strip-types ./scripts/release-check.ts audit",
     "release:bundle": "node --experimental-strip-types ./scripts/release-bundle.ts",
     "release:check": "npm run build && node --experimental-strip-types ./scripts/release-check.ts all",
@@ -57,7 +58,7 @@
     "typecheck:smoke": "tsc -p tsconfig.smoke.json --noEmit"
   },
   "dependencies": {
-    "zod": "^4.4.3"
+    "zod": "^4.6.6"
   },
   "devDependencies": {
     "@types/node": "^24.13.3",

package/release-gates.json

@@ -290,8 +290,8 @@
       "release-gates.json"
     ],
     "baseline": {
-      "version": "0.22.0",
-      "packedBytes": 167762
+      "version": "0.23.0",
+      "packedBytes": 167815
     },
     "browserEntries": {}
   },