@softspark/jira-mcp 1.4.0 → 1.4.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +20 -0
- package/README.md +6 -6
- package/dist/cli.js +33 -33
- package/dist/index.js +23 -23
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -7,6 +7,26 @@ Versioning follows [Semantic Versioning](https://semver.org/).
|
|
|
7
7
|
|
|
8
8
|
---
|
|
9
9
|
|
|
10
|
+
## v1.4.2 -- Supply-Chain Hardening (2026-04-18)
|
|
11
|
+
|
|
12
|
+
### Added
|
|
13
|
+
- **npm provenance attestation** -- `publish.yml` now publishes with `--provenance` and `id-token: write`, producing a SLSA v1 attestation on every release. Consumers can verify via `npm audit signatures` or the Provenance badge on npmjs.com.
|
|
14
|
+
- **Supply-chain gates in release SOP** -- `kb/procedures/sop-release.md` adds a pre-tag check for `--provenance` and `id-token: write` in `publish.yml`, plus a post-publish step that asserts `predicateType == https://slsa.dev/provenance/v1`.
|
|
15
|
+
- **Provenance verification in post-release SOP** -- `kb/procedures/sop-post-release-testing.md` adds Phase 5 covering the SLSA attestation check, `npm audit signatures`, and the npmjs.com Provenance badge.
|
|
16
|
+
- **Version-sync step in pre-commit SOP** -- `kb/procedures/sop-pre-commit.md` adds Step 6 verifying `package.json` and `package-lock.json` agree on the `version` field.
|
|
17
|
+
|
|
18
|
+
### Changed
|
|
19
|
+
- **Release workflow permissions** -- `packages: write` and `id-token: write` added to `.github/workflows/publish.yml` for OIDC attestation.
|
|
20
|
+
- **Release commit now stages the lockfile** -- SOP Phase 5 stages `package.json`, `package-lock.json`, `CHANGELOG.md`, and `README.md`. Prevents lockfile drift between tags.
|
|
21
|
+
|
|
22
|
+
### Fixed
|
|
23
|
+
- **`package-lock.json` top-level version drift** -- lockfile root `version` was stuck at `1.0.0` across prior releases. Regenerated via `npm install --package-lock-only` and now matches `package.json` on every release commit.
|
|
24
|
+
|
|
25
|
+
## v1.4.1 -- Template Loading Fix (2026-04-15)
|
|
26
|
+
|
|
27
|
+
### Fixed
|
|
28
|
+
- **File-backed templates missing after install** -- `PACKAGE_ROOT_DIR` used a hardcoded `../..` relative depth that resolved correctly in the source layout but overshot by one level after tsup bundling. Replaced with `findPackageRoot()` that walks up looking for `package.json`. All 8 built-in comment templates now load correctly from global installs.
|
|
29
|
+
|
|
10
30
|
## v1.4.0 -- Delete Tools & Error Hardening (2026-04-15)
|
|
11
31
|
|
|
12
32
|
### Added
|
package/README.md
CHANGED
|
@@ -4,17 +4,17 @@
|
|
|
4
4
|
|
|
5
5
|
[](https://github.com/softspark/jira-mcp/actions/workflows/ci.yml)
|
|
6
6
|
[](https://www.npmjs.com/package/@softspark/jira-mcp)
|
|
7
|
-
[](CHANGELOG.md)
|
|
8
8
|
[](LICENSE)
|
|
9
9
|
|
|
10
10
|
---
|
|
11
11
|
|
|
12
|
-
## What's New in v1.4.
|
|
12
|
+
## What's New in v1.4.2
|
|
13
13
|
|
|
14
|
-
-
|
|
15
|
-
- **
|
|
16
|
-
- **
|
|
17
|
-
- **
|
|
14
|
+
- **npm provenance attestation** -- releases now ship with SLSA v1 attestation via `npm publish --provenance`. Verify with `npm audit signatures` or the Provenance badge on npmjs.com.
|
|
15
|
+
- **Release SOP hardening** -- supply-chain gates (`--provenance`, `id-token: write`) and a lockfile sync step are now part of the pre-tag checklist.
|
|
16
|
+
- **Post-release verification** -- new phase asserts the SLSA provenance predicate and runs `npm audit signatures` before the release is considered shipped.
|
|
17
|
+
- **Pre-commit version sync** -- new step catches `package.json` ↔ `package-lock.json` version drift before commit.
|
|
18
18
|
|
|
19
19
|
See [CHANGELOG.md](CHANGELOG.md) for full details.
|
|
20
20
|
|