@quobix/vacuum 0.31.0 → 0.33.0

package/README.md

@@ -4,7 +4,7 @@
 </picture>
 
 
-# The world's fastest OpenAPI, AsyncAPI and JSON Schema linter.
+# The world's fastest OpenAPI, AsyncAPI, Arazzo and JSON Schema linter.
 
 ![build](https://github.com/daveshanley/vacuum/workflows/Build/badge.svg)
 [![discord](https://img.shields.io/discord/923258363540815912)](https://discord.gg/UAcUF78MQN)
@@ -13,7 +13,7 @@
 [![Docker Pulls](https://img.shields.io/docker/pulls/dshanley/vacuum?style=flat-square)](https://hub.docker.com/r/dshanley/vacuum)
 [![Mentioned in Awesome Go](https://awesome.re/mentioned-badge-flat.svg)](https://github.com/avelino/awesome-go)
 
-An **ultra-super-fast**, lightweight OpenAPI, AsyncAPI and JSON Schema linter and quality checking tool inspired by [Spectral](https://github.com/stoplightio/spectral).
+An **ultra-super-fast**, lightweight OpenAPI, AsyncAPI, Arazzo and JSON Schema linter and quality checking tool inspired by [Spectral](https://github.com/stoplightio/spectral).
 
 It supports Spectral-style YAML and JSON rulesets. See [Spectral migration](#spectral-migration) for compatibility limits and built-in alternatives.
 
@@ -139,7 +139,25 @@ come say hi!
 
 ## Documentation
 
-🔥 **New in** `v0.29` 🔥: **Lint AsyncAPI 3 documents in vacuum**
+🔥 **New in** `v0.33` 🔥: **Arazzo workflow linting and a new `or` function**
+
+Arazzo 1.0 and 1.1 workflows are now a first-class document type in vacuum, alongside OpenAPI, AsyncAPI and JSON Schema.
+Use `vacuum lint workflows.yaml` and vacuum will detect Arazzo automatically, with recommended rules for workflow structure,
+references, parameters, expressions and linked source documents. Results work in the normal reports, dashboard and editor diagnostics.
+
+The new `or` core function checks that **at least one of two or more properties exists**. Use
+`properties: [title, summary, description]` to require one of those fields. A property counts as present even when its
+value is `null`, `false`, `0` or an empty string.
+
+This release also fixes AsyncAPI header, server and version checks, and improves result locations for YAML aliases and shared references.
+
+- [Read more about Arazzo linting in vacuum](https://quobix.com/vacuum/arazzo/)
+- [See the default Arazzo ruleset](https://quobix.com/vacuum/rulesets/arazzo-recommended/)
+- [Read more about the new `or` function](https://quobix.com/vacuum/functions/core/or/)
+
+---
+
+`v0.29`: **Lint AsyncAPI 3 documents in vacuum**
 
 [AsyncAPI](https://www.asyncapi.com) is now a first-class document type in vacuum, alongside OpenAPI and JSON Schema.
 Use the normal `lint` command and vacuum will detect AsyncAPI 3 documents automatically.
@@ -152,7 +170,7 @@ Use the normal `lint` command and vacuum will detect AsyncAPI 3 documents automa
 
 ---
 
-🔥 **New in** `v0.28` 🔥: **Lint JSON Schema documents in vacuum**
+`v0.28`: **Lint JSON Schema documents in vacuum**
 
 A new `schema` command has been added that opens up vacuum to JSON Schema specific linting rules and checks! 
 With a whole new set of functions and rules, specifically for JSON Schema documents. 
@@ -226,6 +244,28 @@ target exactly what we want to change. vacuum now supports a new `apply-overlay`
 
 - [Learn more about the apply-overlay command](https://quobix.com/vacuum/commands/apply-overlay)
 
+`apply-overlay` can also build a fail-closed publication document after applying
+the standard Overlay actions:
+
+```bash
+vacuum apply-overlay internal.yaml public.overlay.yaml public.yaml \
+  --include-tag public \
+  --tag-match any \
+  --prune-unused
+```
+
+Inclusive tags are exact and case-sensitive; `any` keeps operations with at
+least one included tag and `all` requires every included tag. Untagged
+operations are removed. Filtering runs after Overlay actions and before
+reachability-based component pruning. These opt-in transforms require a
+bundled, self-contained OpenAPI document. Top-level Tag Objects are retained.
+YAML aliases and merge keys are expanded when filtering. Retained mapping
+order, comments, and scalar styles are preserved. Pruning rejects schema
+`$id` scopes that cannot be resolved safely. Link Objects targeting filtered
+operations are retained and reported as warnings. Document output remains
+pure on stdout; warnings are written to stderr. The warning summary uses the `apply-overlay produced` prefix to
+cover both Overlay actions and publication transforms.
+
 ---
 
 
@@ -501,6 +541,30 @@ if you're interested in seeing how things are progressing, it's available.
 ```
 
 ---
+## OWASP hard mode
+
+Run `vacuum lint --hard-mode api.yaml` to enable all built-in OpenAPI rules,
+including the OWASP rules. Hard mode checks:
+
+- OAuth [password](https://quobix.com/vacuum/rules/owasp/owasp-oauth-no-password/)
+  and [implicit](https://quobix.com/vacuum/rules/owasp/owasp-oauth-no-implicit/) flows.
+- [Authentication endpoint URLs](https://quobix.com/vacuum/rules/owasp/owasp-auth-urls-https/)
+  and server URLs for HTTPS, including overrides and server variables.
+- Request objects for unrestricted fields and maps for property-count limits.
+- Write operations for authenticated security requirements, without anonymous alternatives.
+- Declared JWTs for an RFC8725 reference in their description, as a warning.
+
+**Changes for existing users:** strict write security now reports an **error**,
+previously informational. A requirement such as `security: [{auth: []}, {}]` can
+now fail a build. Also, `x-lint-ignore` applies to the entire subtree beneath its
+location for every ruleset, rather than only the node and its immediate children.
+
+See the [OWASP guide](https://quobix.com/vacuum/rulesets/owasp/) for rule details
+and severity overrides, and [ignoring violations](https://quobix.com/vacuum/ignoring/)
+for scoped exceptions.
+
+---
+
 ## Spectral migration
 
 vacuum loads YAML and JSON rulesets. Resolve each relative `extends` path from the
@@ -518,9 +582,10 @@ Use `[vacuum:owasp, all]` for vacuum's built-in OWASP checks instead of importin
 rule names and behavior; they do not execute the Spectral package. JavaScript
 ruleset modules (`.js`, `.mjs`, `.cjs`) are not supported.
 
-Arazzo workflow linting and `spectral:arazzo` are not supported. Remove that entry
-from rulesets used to lint OpenAPI documents. Use an Arazzo-capable linter for
-Arazzo workflow documents.
+Arazzo 1.0 and 1.1 workflows use `vacuum lint workflows.yaml` and the normal
+report commands. `spectral:arazzo` selects Vacuum's native recommended rules.
+See [Arazzo linting](ARAZZO.md) for source lookup, rule IDs, incomplete checks
+and migration differences.
 
 `--functions` takes a directory containing custom function files:
 
@@ -623,9 +688,14 @@ lint:
 
 ### Environment variables
 
-You can configure global vacuum flags using environment variables in the form of: `VACUUM_<flag>`
+You can configure global and command-local flags with `VACUUM_<FLAG>`
+environment variables. Use uppercase flag names and replace `-` with `_`.
+Explicit command-line flags take precedence over environment variables;
+environment variables take precedence over configuration files.
 
-If a flag, has a `-` in it, replace with `_`
+Collection flags accept comma-separated values. For example,
+`VACUUM_INCLUDE_TAG='public,partner'` sets the included tags for
+`apply-overlay`.
 
 
 ## Auto-fixing rule violations

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@quobix/vacuum",
-  "version": "0.31.0",
+  "version": "0.33.0",
   "description": "The world's fastest, most scalable and complete OpenAPI parser",
   "type": "module",
   "author": "Dave Shanley",