@plasius/sharedassets 1.0.15 → 1.0.17

package/CHANGELOG.md

@@ -8,6 +8,60 @@ The format is based on **[Keep a Changelog](https://keepachangelog.com/en/1.1.0/
 
 ## [Unreleased]
 
+- **Added**
+  - (placeholder)
+
+- **Changed**
+  - (placeholder)
+
+- **Fixed**
+  - (placeholder)
+
+- **Security**
+  - (placeholder)
+
+## [1.0.17] - 2026-09-20
+
+- Refresh npm dependency lockfile to current supported stable versions (weekly maintenance, 2026-09-20).
+
+- **Added**
+  - (placeholder)
+
+- **Changed**
+  - (placeholder)
+
+- **Fixed**
+  - (placeholder)
+
+- **Security**
+  - (placeholder)
+
+## [1.0.16] - 2026-09-13
+
+### Changed
+- Refresh compatible npm dependencies from the registry for the weekly dependency maintenance wave.
+
+
+- **Added**
+  - (placeholder)
+
+- **Changed**
+  - Bound npm publication to the exact prepared `main` commit after successful push-triggered CI.
+  - (placeholder)
+
+- **Fixed**
+  - Moved reviewed CI to explicit GitHub-hosted runners with package-manager caching disabled and added exact-branch manual validation.
+  - (placeholder)
+
+- **Security**
+  - Updated Vitest and its coverage adapter to 4.1.11, clearing the patched redirect-mock path traversal advisory.
+  - Removed the npm write-token path, added a fail-closed npm 11.5.1-or-newer OIDC guard, and denied fork PR code access to self-hosted CI.
+  - Pinned patched transitive npm dependencies to clear the current audit baseline.
+  - Added fail-closed source and npm-package admission for the administrative contributor registry and pinned the CI/CD runtime to Node.js 24.18.0 LTS.
+  - (placeholder)
+
+## [1.0.15] - 2026-06-30
+
 - **Added**
   - Added exported Plasius logo variants for chrome-shell branding while preserving the canonical logo asset.
 
@@ -18,6 +72,7 @@ The format is based on **[Keep a Changelog](https://keepachangelog.com/en/1.1.0/
   - (placeholder)
 
 - **Security**
+  - Raised the `fast-uri` override to the patched 3.1.x line to clear the four high-severity host-confusion and SSRF advisories.
   - (placeholder)
 
 ## [1.0.14] - 2026-06-22
@@ -191,7 +246,7 @@ The format is based on **[Keep a Changelog](https://keepachangelog.com/en/1.1.0/
 
 ---
 
-[Unreleased]: https://github.com/Plasius-LTD/sharedassets/compare/v1.0.14...HEAD
+[Unreleased]: https://github.com/Plasius-LTD/sharedassets/compare/v1.0.17...HEAD
 
 ## [1.0.0] - 2026-02-11
 
@@ -217,3 +272,6 @@ The format is based on **[Keep a Changelog](https://keepachangelog.com/en/1.1.0/
 [1.0.11]: https://github.com/Plasius-LTD/sharedassets/releases/tag/v1.0.11
 [1.0.13]: https://github.com/Plasius-LTD/sharedassets/releases/tag/v1.0.13
 [1.0.14]: https://github.com/Plasius-LTD/sharedassets/releases/tag/v1.0.14
+[1.0.15]: https://github.com/Plasius-LTD/sharedassets/releases/tag/v1.0.15
+[1.0.16]: https://github.com/Plasius-LTD/sharedassets/releases/tag/v1.0.16
+[1.0.17]: https://github.com/Plasius-LTD/sharedassets/releases/tag/v1.0.17

package/README.md

@@ -47,3 +47,15 @@ npm test
 ## License
 
 MIT
+
+<!-- BEGIN PLASIUS RELEASE INTEGRITY -->
+## Release integrity
+
+CI keeps the administrative contributor registry outside Git and npm package
+artifacts using exact, case-normalised path checks. Reviewed CI runs on explicit
+GitHub-hosted runners with package-manager caching disabled; fork PR code is
+denied. Publication uses the GitHub-hosted `production` job with Node 24 and
+pinned npm 11.6.2. It is token-free and proceeds only while the prepared SHA
+is the exact `main` head after successful push-triggered CI. Do not dispatch CD
+until the npm trusted-publisher binding is verified.
+<!-- END PLASIUS RELEASE INTEGRITY -->

package/docs/adrs/adr-0004-hosted-oidc-package-publication.md

@@ -0,0 +1,29 @@
+# ADR-0004: Hosted OIDC Package Publication
+
+- Status: Accepted
+- Date: 2026-08-11
+
+## Context
+
+`@plasius/sharedassets` must publish without a long-lived npm write token and without
+accepting CI evidence for another source snapshot.
+
+## Decision
+
+Publication is phase-isolated: dependency installation, package validation, SBOM generation, and immutable tarball packing run in `validate_and_pack` without the `production` environment or OIDC permission. The final hosted `publish` job downloads only that sealed artifact, explicitly installs npm 11.6.2, runs no repository dependency code, and publishes the tarball with lifecycle scripts disabled. It re-fetches current `main` immediately before the first release mutation and again immediately before npm publication. `.npmrc` contains no registry-auth placeholder, and release preparation returns the reviewed current `main` HEAD rather than package-file history.
+
+Publish only from the GitHub-hosted `production` job using npm trusted
+publishing. Prove the prepared SHA is still the exact remote `main` head and
+that push-triggered `ci.yml` succeeded for it. Require Node 24 and npm 11.5.1 or
+newer, request provenance, and prohibit npm write-token fallbacks. Reviewed CI
+uses explicit GitHub-hosted runners with package-manager caching disabled; fork
+PR code is denied.
+
+## Consequences
+
+Missing trust configuration, moved `main`, absent CI, unsupported runtime, or
+missing OIDC identity fails closed before publication.
+
+## Test implications
+
+Workflow tests enforce source, CI, runtime, identity, runner, and token rules.

package/docs/adrs/index.md

@@ -3,3 +3,4 @@
 - [ADR-0001: Standalone @plasius/sharedassets Package Scope](./adr-0001-sharedassets-package-scope.md)
 - [ADR-0002: Public Repository Governance Baseline](./adr-0002-public-repo-governance.md)
 - [ADR-0003: Dual ESM and CJS Runtime Compatibility](./adr-0003-dual-esm-cjs-runtime-compatibility.md)
+- [ADR-0004: Hosted OIDC Package Publication](./adr-0004-hosted-oidc-package-publication.md)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plasius/sharedassets",
-  "version": "1.0.15",
+  "version": "1.0.17",
   "description": "Plasius shared asset library, allowing devs to utilise common components",
   "keywords": [
     "Components",
@@ -39,7 +39,7 @@
     "@types/react": "^19.2.14",
     "@typescript-eslint/eslint-plugin": "^8.59.3",
     "@typescript-eslint/parser": "^8.59.3",
-    "@vitest/coverage-v8": "^4.1.6",
+    "@vitest/coverage-v8": "^4.1.11",
     "ajv": "^8.20.0",
     "eslint": "^10.3.0",
     "globals": "^17.6.0",
@@ -47,7 +47,7 @@
     "react": "^19.2.6",
     "tsx": "^4.21.0",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.6",
+    "vitest": "^4.1.11",
     "zod": "^4.4.3"
   },
   "sideEffects": [
@@ -100,6 +100,9 @@
     "node": ">=24"
   },
   "overrides": {
+    "brace-expansion": "5.0.9",
+    "nanoid": "3.3.18",
+    "fast-uri": "^3.1.6",
     "minimatch": "^10.2.1"
   }
 }

package/legal/CLA-REGISTRY.csv

@@ -1 +0,0 @@
-type,github_handle,full_name,company,email,date,approver