@pho9ubenaa/siro 0.4.1 → 0.4.2

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## [0.4.2]
+
+### Fixes
+
+- Correct the development dependency audit script to read pnpm advisories and OSV's nested package findings. Fail on malformed reports, command errors, and incomplete scans; preserve vulnerability exit status and advisory details.
+- Use an installed official OSV-Scanner binary and explicitly report its absence. Remove automatic scanner downloads and bound command execution and output size.
+
+### Maintenance
+
+- Run main-branch CI on pull requests to avoid duplicate checks after merges. Publication still runs full verification for version tags.
+- Set the pnpm minimum release age and Dependabot Action-update cooldown to seven days, and align the threat model with those settings.
+
 ## [0.4.1]
 
 ### Maintenance

package/dist/cli.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { C as SUPPORTED_NODE_RANGE, D as isNodeError, M as UsageError, O as asAbsPath, S as isSeverity, T as assertDirectory, _ as PROJECT_TYPES, b as SEVERITIES, c as DEFAULT_REPORTER_NAME, f as version, j as SiroError, l as JSON_REPORTER_NAME, m as loadConfig, n as lintCommand, s as BUILTIN_REPORTER_NAMES, t as nodeIO, v as isProjectType, w as isSupportedNodeVersion, x as isPM, y as PMS } from "./node-io-DIRcPNSN.mjs";
+import { C as SUPPORTED_NODE_RANGE, D as isNodeError, M as UsageError, O as asAbsPath, S as isSeverity, T as assertDirectory, _ as PROJECT_TYPES, b as SEVERITIES, c as DEFAULT_REPORTER_NAME, f as version, j as SiroError, l as JSON_REPORTER_NAME, m as loadConfig, n as lintCommand, s as BUILTIN_REPORTER_NAMES, t as nodeIO, v as isProjectType, w as isSupportedNodeVersion, x as isPM, y as PMS } from "./node-io-BN34YwoL.mjs";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
 import { parseArgs } from "node:util";

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { A as ConfigError, E as nodeFileSystem, M as UsageError, O as asAbsPath, S as isSeverity, _ as PROJECT_TYPES, a as overrideBindings, b as SEVERITIES, d as jsonReporter, f as version, g as getByPath, h as defineRule, i as CONFIG_FILES, j as SiroError, k as asRelPath, m as loadConfig, n as lintCommand, o as requireConfigKey, p as githubReporter, r as lint, s as BUILTIN_REPORTER_NAMES, t as nodeIO, u as prettyReporter, x as isPM, y as PMS } from "./node-io-DIRcPNSN.mjs";
+import { A as ConfigError, E as nodeFileSystem, M as UsageError, O as asAbsPath, S as isSeverity, _ as PROJECT_TYPES, a as overrideBindings, b as SEVERITIES, d as jsonReporter, f as version, g as getByPath, h as defineRule, i as CONFIG_FILES, j as SiroError, k as asRelPath, m as loadConfig, n as lintCommand, o as requireConfigKey, p as githubReporter, r as lint, s as BUILTIN_REPORTER_NAMES, t as nodeIO, u as prettyReporter, x as isPM, y as PMS } from "./node-io-BN34YwoL.mjs";
 //#region src/domain/entities/siro-config.ts
 /** Identity helper for type-checked config files. */
 const defineConfig = (config) => config;

package/dist/{node-io-DIRcPNSN.mjs → node-io-BN34YwoL.mjs}

@@ -87,7 +87,7 @@ const assertDirectory = (root) => {
 };
 //#endregion
 //#region package.json
-var version$1 = "0.4.1";
+var version$1 = "0.4.2";
 //#endregion
 //#region src/shared/node-version.ts
 const SUPPORTED_NODE_RANGE = { "node": "^22.18.0 || ^24.0.0" }.node;
@@ -2208,4 +2208,4 @@ const nodeIO = {
 //#endregion
 export { ConfigError as A, SUPPORTED_NODE_RANGE as C, isNodeError as D, nodeFileSystem as E, UsageError as M, asAbsPath as O, isSeverity as S, assertDirectory as T, PROJECT_TYPES as _, overrideBindings as a, SEVERITIES as b, DEFAULT_REPORTER_NAME as c, jsonReporter as d, version as f, getByPath as g, defineRule as h, CONFIG_FILES as i, SiroError as j, asRelPath as k, JSON_REPORTER_NAME as l, loadConfig as m, lintCommand as n, requireConfigKey as o, githubReporter as p, lint as r, BUILTIN_REPORTER_NAMES as s, nodeIO as t, prettyReporter as u, isProjectType as v, isSupportedNodeVersion as w, isPM as x, PMS as y };
 
-//# sourceMappingURL=node-io-DIRcPNSN.mjs.map
+//# sourceMappingURL=node-io-BN34YwoL.mjs.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pho9ubenaa/siro",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "Security best-practices linter for the npm ecosystem (npm, pnpm, deno, bun, yarn, aube).",
   "keywords": [
     "aube",
@@ -82,6 +82,7 @@
     "gen": "pnpm gen:docs && pnpm gen:api",
     "gen:api": "typedoc",
     "knip": "knip",
+    "security:scan": "node scripts/security-audit.mjs",
     "test": "pnpm build && vitest run",
     "test:coverage": "pnpm build && vitest run --coverage",
     "typecheck": "tsc --noEmit",