@quecue/dev-notify 0.2.2 → 0.2.3

package/CHANGELOG.en.md

@@ -2,6 +2,11 @@
 
 English | [简体中文](CHANGELOG.md)
 
+## 0.2.3 — 2026-11-07
+
+- Change `@quecue/notify-core` from exact `0.1.0` to the compatible range `^0.1.0`, allowing stable releases `>=0.1.0 <0.2.0`. The lockfile still pins the tested `0.1.0`; update package validation and tests accordingly. This does not change the published `0.2.2`.
+- Regression on Windows x64 / Node 24 totals 219 tests: 218 passed, 0 failed, and 1 opt-in native credential test skipped; this does not establish real-machine acceptance on every platform.
+
 ## 0.2.2 — 2026-11-07
 
 Communication dependency extraction, Windows file-replacement fixes, and documentation updates. Actual version availability is authoritative on the npm registry; the changes below are not included in `0.2.1`.

package/CHANGELOG.md

@@ -2,6 +2,11 @@
 
 简体中文 | [English](CHANGELOG.en.md)
 
+## 0.2.3 — 2026-11-07
+
+- 将 `@quecue/notify-core` 依赖由精确 `0.1.0` 改为兼容范围 `^0.1.0`，允许 `>=0.1.0 <0.2.0` 的稳定版本。锁文件仍固定已验证的 `0.1.0`；同步发布校验和测试。此调整不改变已发布的 `0.2.2`。
+- Windows x64／Node 24 回归共 219 项：218 通过、0 失败、1 项显式原生凭据测试跳过；不代表各平台实机验收。
+
 ## 0.2.2 — 2026-11-07
 
 通讯层依赖提取、Windows 文件替换修复与文档更新。实际版本可用性以 npm registry 为准；以下变更不包含在 `0.2.1` 中。

package/README.en.md

@@ -6,11 +6,11 @@ Cross-platform developer task notification tool written in **TypeScript / Node.j
 
 **The npm package name is `@quecue/dev-notify`, with general notifications, Claude Code remote replies, and local/Telegram two-sided question answering and result feedback.** Source repository: [QueCue/dev-notify](https://github.com/QueCue/dev-notify). For changes and upgrade notes, see [CHANGELOG.en.md](CHANGELOG.en.md); published versions and distribution tags are authoritative on the npm registry, and source changes do not constitute a release.
 
-### Communication dependency in 0.2.2 source
+### Communication dependency in current source
 
-The current 0.2.2 source extracts Telegram/Feishu communication into the standard npm runtime dependency `@quecue/notify-core`, pinned to exactly `0.1.0`. Source: [QueCue/notify-core](https://github.com/QueCue/notify-core). This structure does not describe the published `0.2.1` package.
+Starting with 0.2.3, the standard npm runtime dependency is `@quecue/notify-core` with range `^0.1.0`, allowing stable releases `>=0.1.0 <0.2.0`. Source: [QueCue/notify-core](https://github.com/QueCue/notify-core). The published `0.2.2` still requires exact `0.1.0`; actual version availability is authoritative on the npm registry.
 
-npm installs the dependency; builds compile only this application without copying the communication library or linking sibling source. npm users do not install the library manually. `@quecue/notify-core@0.1.0` has been published through GitHub Actions. The lockfile pins its registry source and integrity; use `npm ci --ignore-scripts` for source development.
+npm installs the dependency; builds compile only this application without copying the communication library or linking sibling source. npm users do not install the library manually. `@quecue/notify-core@0.1.0` has been published through GitHub Actions. The lockfile still pins the tested `0.1.0`, its registry source and integrity. Source development uses `npm ci --ignore-scripts` for exact restoration; widening the range does not automatically update the lockfile. Normal installation permits compatible releases but does not guarantee a fresh download or the newest patch on every upgrade.
 
 ## Installation and usage
 

package/README.md

@@ -6,11 +6,11 @@
 
 **npm 包名为 `@quecue/dev-notify`，支持通用通知、Claude Code 远程回复，以及本机与 Telegram 双端答题和结果反馈。** 源码仓库：[QueCue/dev-notify](https://github.com/QueCue/dev-notify)。版本变更与升级说明见 [CHANGELOG.md](CHANGELOG.md)；公开版本和发布标签以 npm registry 为准，源码更新不等同于已发布。
 
-### 0.2.2 源码的通讯层依赖
+### 当前源码的通讯层依赖
 
-当前 0.2.2 源码将 Telegram／飞书通讯层提取为标准 npm 运行时依赖 `@quecue/notify-core`，精确版本为 `0.1.0`，源码见 [QueCue/notify-core](https://github.com/QueCue/notify-core)。此结构不代表已发布的 `0.2.1` 包。
+从 0.2.3 起使用标准 npm 运行时依赖 `@quecue/notify-core`，范围为 `^0.1.0`，允许 `>=0.1.0 <0.2.0` 的稳定版本，源码见 [QueCue/notify-core](https://github.com/QueCue/notify-core)。已发布的 `0.2.2` 仍精确依赖 `0.1.0`；版本实际可用性以 npm registry 为准。
 
-依赖由 npm 安装，构建只编译本应用，不复制通讯库或链接兄弟仓库源码。npm 用户无需手动安装通讯库。`@quecue/notify-core@0.1.0` 已通过 GitHub Actions 发布，锁文件固定其 registry 来源和 integrity；源码开发使用 `npm ci --ignore-scripts` 还原依赖。
+依赖由 npm 安装，构建只编译本应用，不复制通讯库或链接兄弟仓库源码。npm 用户无需手动安装通讯库。`@quecue/notify-core@0.1.0` 已通过 GitHub Actions 发布，锁文件仍固定已验证的 `0.1.0`、registry 来源和 integrity；源码开发使用 `npm ci --ignore-scripts` 精确还原，不会因为版本范围放宽自动更新锁文件。正常安装允许兼容版本，不保证每次升级都会重新下载依赖或强制选择最新补丁。
 
 ## 安装与使用
 

package/SECURITY.en.md

@@ -2,11 +2,11 @@
 
 English | [简体中文](SECURITY.md)
 
-The npm package name is `@quecue/dev-notify`, with public source at [QueCue/dev-notify](https://github.com/QueCue/dev-notify). Published versions are authoritative on the npm registry; this document describes the 0.2.2 source, and a source version alone does not establish that an installation package has been published. This project has not completed a security audit or real-machine acceptance on both platforms.
+The npm package name is `@quecue/dev-notify`, with public source at [QueCue/dev-notify](https://github.com/QueCue/dev-notify). Published versions are authoritative on the npm registry; this document describes the dependency range and security boundaries of 0.2.3, and a source version alone does not establish that an installation package has been published. This project has not completed a security audit or real-machine acceptance on both platforms.
 
-## Communication dependency in 0.2.2 source
+## Communication dependency in current source
 
-The current 0.2.2 source uses the standard npm runtime dependency `@quecue/notify-core`, pinned to exactly `0.1.0`, with source at [QueCue/notify-core](https://github.com/QueCue/notify-core). Builds do not embed the library or link sibling source; npm installs it automatically. This does not describe the published `0.2.1` package. The library's `0.1.0` release was published through its own GitHub Actions OIDC identity; the lockfile pins the official registry source and SHA512. Neither provenance nor integrity verification constitutes a security audit.
+Starting with 0.2.3, the standard npm runtime dependency is `@quecue/notify-core` with compatible range `^0.1.0` (stable releases `>=0.1.0 <0.2.0`), with source at [QueCue/notify-core](https://github.com/QueCue/notify-core). Builds do not embed the library or link sibling source; npm installs it automatically. The published `0.2.2` still requires exact `0.1.0`; actual version availability is authoritative on the npm registry. The lockfile still pins the tested `0.1.0` with its official registry source and SHA512 for exact `npm ci` restoration; normal installation permits compatible releases. A permitted version range is not a security guarantee, and neither provenance nor integrity verification constitutes a security audit.
 
 Reusing a dependency does not automatically share credentials or authorization, and a bot's `getUpdates` must still have only one consumer. Upgrade dependencies only from trusted sources; tarball integrity checks in the lockfile do not establish source authenticity or constitute a security audit.
 

package/SECURITY.md

@@ -2,11 +2,11 @@
 
 简体中文 | [English](SECURITY.en.md)
 
-npm 包名为 `@quecue/dev-notify`，公开源码见 [QueCue/dev-notify](https://github.com/QueCue/dev-notify)。发布版本以 npm registry 为准，本文描述 0.2.2 源码，不能仅依据源码版本认定安装包已发布。本项目尚未完成安全审计或双平台实机验收。
+npm 包名为 `@quecue/dev-notify`，公开源码见 [QueCue/dev-notify](https://github.com/QueCue/dev-notify)。发布版本以 npm registry 为准，本文描述 0.2.3 的依赖范围与安全边界，不能仅依据源码版本认定安装包已发布。本项目尚未完成安全审计或双平台实机验收。
 
-## 0.2.2 源码的通讯层依赖
+## 当前源码的通讯层依赖
 
-当前 0.2.2 源码使用标准 npm 运行时依赖 `@quecue/notify-core`，精确版本 `0.1.0`，源码见 [QueCue/notify-core](https://github.com/QueCue/notify-core)。构建不嵌入通讯库、不链接兄弟仓库源码，npm 自动安装该依赖；这不是已发布 `0.2.1` 的结构说明。通讯库 `0.1.0` 已通过独立 GitHub Actions OIDC 发行，锁文件固定正式 registry 来源和 SHA512；包的 provenance 或完整性校验均不等于安全审计。
+从 0.2.3 起使用标准 npm 运行时依赖 `@quecue/notify-core`，兼容范围 `^0.1.0`（稳定版本 `>=0.1.0 <0.2.0`），源码见 [QueCue/notify-core](https://github.com/QueCue/notify-core)。构建不嵌入通讯库、不链接兄弟仓库源码，npm 自动安装该依赖。已发布的 `0.2.2` 仍精确依赖 `0.1.0`；版本实际可用性以 npm registry 为准。锁文件仍固定已验证 `0.1.0` 的正式 registry 来源和 SHA512，`npm ci` 精确还原；普通安装可接受兼容版本。允许的版本范围不是安全保证，包的 provenance 或完整性校验也不等于安全审计。
 
 依赖复用不会自动共享凭据或授权，同一个 Bot 的 `getUpdates` 仍只能由一个消费者使用。依赖只从可信来源升级；锁文件的 tarball integrity 校验不等于来源认证或安全审计。
 

package/dist/cli.js

@@ -16,7 +16,7 @@ import { startBridge, stopBridge, bridgeStatus, runBridge } from './reply-bridge
 import { updatePackage } from './update.js';
 import { postUpdate } from './maintenance.js';
 import { localeName, parseLocale, resolveLocale, setLocale, t } from './i18n.js';
-export const VERSION = '0.2.2';
+export const VERSION = '0.2.3';
 const helpText = () => t('cli.help', { version: VERSION });
 function rawLang(argv) {
     for (let i = 0; i < argv.length; i++) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@quecue/dev-notify",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "description": "跨平台开发任务通知工具，支持 Telegram 与飞书",
   "license": "MIT",
   "repository": {
@@ -40,7 +40,7 @@
   },
   "dependencies": {
     "@napi-rs/keyring": "2.1.2",
-    "@quecue/notify-core": "0.1.0"
+    "@quecue/notify-core": "^0.1.0"
   },
   "publishConfig": {
     "access": "public",