@pho9ubenaa/siro 0.4.1 → 0.4.3

package/CHANGELOG.md

@@ -1,5 +1,27 @@
 # Changelog
 
+## [0.4.3]
+
+### Maintenance
+
+- Verify the packed package from an isolated consumer on both supported Node majors in CI. Check distributed files, installed CLI exit codes, package exports, custom rules, JSON output, and strict TypeScript declaration resolution without development dependency types.
+- Verify the same tarball before staging it for npm publication, preferring cached dependencies with install scripts disabled.
+- Centralize packing, verification, and temporary-file cleanup in `pnpm test:package`; retain the verified artifact on request for publication.
+- Move the release tag/version check into a standalone script while preserving the rejection of private packages and mismatched tags before installation and publication.
+- Allow bounded startup headroom for audit subprocess tests on shared runners and report process failures before reading their output records.
+
+## [0.4.2]
+
+### Fixes
+
+- Correct the development dependency audit script to read pnpm advisories and OSV's nested package findings. Fail on malformed reports, command errors, and incomplete scans; preserve vulnerability exit status and advisory details.
+- Use an installed official OSV-Scanner binary and explicitly report its absence. Remove automatic scanner downloads and bound command execution and output size.
+
+### Maintenance
+
+- Run main-branch CI on pull requests to avoid duplicate checks after merges. Publication still runs full verification for version tags.
+- Set the pnpm minimum release age and Dependabot Action-update cooldown to seven days, and align the threat model with those settings.
+
 ## [0.4.1]
 
 ### Maintenance

package/dist/cli.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { C as SUPPORTED_NODE_RANGE, D as isNodeError, M as UsageError, O as asAbsPath, S as isSeverity, T as assertDirectory, _ as PROJECT_TYPES, b as SEVERITIES, c as DEFAULT_REPORTER_NAME, f as version, j as SiroError, l as JSON_REPORTER_NAME, m as loadConfig, n as lintCommand, s as BUILTIN_REPORTER_NAMES, t as nodeIO, v as isProjectType, w as isSupportedNodeVersion, x as isPM, y as PMS } from "./node-io-DIRcPNSN.mjs";
+import { C as SUPPORTED_NODE_RANGE, D as isNodeError, M as UsageError, O as asAbsPath, S as isSeverity, T as assertDirectory, _ as PROJECT_TYPES, b as SEVERITIES, c as DEFAULT_REPORTER_NAME, f as version, j as SiroError, l as JSON_REPORTER_NAME, m as loadConfig, n as lintCommand, s as BUILTIN_REPORTER_NAMES, t as nodeIO, v as isProjectType, w as isSupportedNodeVersion, x as isPM, y as PMS } from "./node-io-B3Hbcwyn.mjs";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
 import { parseArgs } from "node:util";

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { A as ConfigError, E as nodeFileSystem, M as UsageError, O as asAbsPath, S as isSeverity, _ as PROJECT_TYPES, a as overrideBindings, b as SEVERITIES, d as jsonReporter, f as version, g as getByPath, h as defineRule, i as CONFIG_FILES, j as SiroError, k as asRelPath, m as loadConfig, n as lintCommand, o as requireConfigKey, p as githubReporter, r as lint, s as BUILTIN_REPORTER_NAMES, t as nodeIO, u as prettyReporter, x as isPM, y as PMS } from "./node-io-DIRcPNSN.mjs";
+import { A as ConfigError, E as nodeFileSystem, M as UsageError, O as asAbsPath, S as isSeverity, _ as PROJECT_TYPES, a as overrideBindings, b as SEVERITIES, d as jsonReporter, f as version, g as getByPath, h as defineRule, i as CONFIG_FILES, j as SiroError, k as asRelPath, m as loadConfig, n as lintCommand, o as requireConfigKey, p as githubReporter, r as lint, s as BUILTIN_REPORTER_NAMES, t as nodeIO, u as prettyReporter, x as isPM, y as PMS } from "./node-io-B3Hbcwyn.mjs";
 //#region src/domain/entities/siro-config.ts
 /** Identity helper for type-checked config files. */
 const defineConfig = (config) => config;

package/dist/{node-io-DIRcPNSN.mjs → node-io-B3Hbcwyn.mjs}

@@ -87,7 +87,7 @@ const assertDirectory = (root) => {
 };
 //#endregion
 //#region package.json
-var version$1 = "0.4.1";
+var version$1 = "0.4.3";
 //#endregion
 //#region src/shared/node-version.ts
 const SUPPORTED_NODE_RANGE = { "node": "^22.18.0 || ^24.0.0" }.node;
@@ -2208,4 +2208,4 @@ const nodeIO = {
 //#endregion
 export { ConfigError as A, SUPPORTED_NODE_RANGE as C, isNodeError as D, nodeFileSystem as E, UsageError as M, asAbsPath as O, isSeverity as S, assertDirectory as T, PROJECT_TYPES as _, overrideBindings as a, SEVERITIES as b, DEFAULT_REPORTER_NAME as c, jsonReporter as d, version as f, getByPath as g, defineRule as h, CONFIG_FILES as i, SiroError as j, asRelPath as k, JSON_REPORTER_NAME as l, loadConfig as m, lintCommand as n, requireConfigKey as o, githubReporter as p, lint as r, BUILTIN_REPORTER_NAMES as s, nodeIO as t, prettyReporter as u, isProjectType as v, isSupportedNodeVersion as w, isPM as x, PMS as y };
 
-//# sourceMappingURL=node-io-DIRcPNSN.mjs.map
+//# sourceMappingURL=node-io-B3Hbcwyn.mjs.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pho9ubenaa/siro",
-  "version": "0.4.1",
+  "version": "0.4.3",
   "description": "Security best-practices linter for the npm ecosystem (npm, pnpm, deno, bun, yarn, aube).",
   "keywords": [
     "aube",
@@ -82,8 +82,10 @@
     "gen": "pnpm gen:docs && pnpm gen:api",
     "gen:api": "typedoc",
     "knip": "knip",
+    "security:scan": "node scripts/security-audit.mjs",
     "test": "pnpm build && vitest run",
     "test:coverage": "pnpm build && vitest run --coverage",
+    "test:package": "node scripts/verify-package.mjs",
     "typecheck": "tsc --noEmit",
     "gen:docs": "node scripts/docs.ts",
     "check:docs": "node scripts/docs.ts --check",