@stackline/redeyed 1.0.1 → 1.0.2

package/CHANGELOG.md

@@ -7,6 +7,17 @@ Versioning.
 
 ## [Unreleased]
 
+## [1.0.2] - 2026-08-30
+
+### Changed
+
+- Preserve the historical `esprima` dependency key while resolving it exactly
+  to maintained `@stackline/esprima@1.0.0`.
+- Require warning-free packed installs, valid dependency trees, and zero
+  production and full-lockfile audit findings.
+- Correct the npm publication workflow to address the local tarball path
+  explicitly.
+
 ## [1.0.1] - 2026-08-26
 
 ### Added
@@ -45,6 +56,7 @@ Versioning.
   shape, comments, splits, and source retention.
 - Original MIT copyright and permission notice.
 
-[Unreleased]: https://github.com/alexandroit/stackline-redeyed/compare/stackline-v1.0.1...HEAD
+[Unreleased]: https://github.com/alexandroit/stackline-redeyed/compare/stackline-v1.0.2...HEAD
+[1.0.2]: https://github.com/alexandroit/stackline-redeyed/compare/stackline-v1.0.1...stackline-v1.0.2
 [1.0.1]: https://github.com/alexandroit/stackline-redeyed/compare/stackline-v1.0.0...stackline-v1.0.1
 [1.0.0]: https://github.com/alexandroit/stackline-redeyed/tree/stackline-v1.0.0

package/NOTICE

@@ -5,5 +5,7 @@ copyright and MIT license terms are preserved in LICENSE.
 
 Original project: https://github.com/thlorenz/redeyed
 
-Browser bundles include Esprima 4.0.1. Its BSD-2-Clause redistribution terms
-are preserved in THIRD_PARTY_LICENSES.md.
+The historical dependency key `esprima` resolves to maintained
+`@stackline/esprima@1.0.0`. Browser bundles include its Esprima 4.0.1-compatible
+runtime. The BSD-2-Clause redistribution terms are preserved in
+THIRD_PARTY_LICENSES.md.

package/README.md

@@ -15,7 +15,7 @@
 **[Security](SECURITY.md)** |
 **[Changelog](CHANGELOG.md)**
 
-**Current package version:** `1.0.1`
+**Current package version:** `1.0.2`
 
 This package is an independent, maintained continuation of
 [`redeyed`](https://github.com/thlorenz/redeyed). It preserves the established
@@ -168,6 +168,12 @@ differential executions, immutable and hostile-key configs, modern parser
 adapters, hashbang edges, browser/modules/types, package audits, and a direct
 `cardinal` adoption check.
 
+The historical dependency key `esprima` resolves exactly to the maintained
+`@stackline/esprima@1.0.0` compatibility package. It preserves the Esprima
+4.0.1 API while keeping the complete production chain under Stackline release,
+CI, audit, and provenance controls. A clean install reports no warnings and
+zero audit findings.
+
 ## Security
 
 Report vulnerabilities privately as described in [SECURITY.md](SECURITY.md).

package/SECURITY.md

@@ -24,3 +24,10 @@ Upstream issue #22 concerns an old jQuery URL in an example shipped with
 `redeyed@2.1.1`. The example is not executed by the library. Stackline excludes
 that example from npm artifacts, but does not misrepresent the scanner finding
 as a CVE in redeyed's runtime.
+
+## Dependency Chain
+
+Version 1.0.2 preserves the dependency key `esprima` through the exact npm
+alias `npm:@stackline/esprima@1.0.0`. That maintained parser has no production,
+optional, or peer dependencies. Release gates require a warning-free packed
+install, a valid npm tree, and zero production and full-lockfile audit findings.

package/THIRD_PARTY_LICENSES.md

@@ -1,6 +1,6 @@
 # Third-Party Licenses
 
-## Esprima 4.0.1 (BSD-2-Clause)
+## @stackline/esprima 1.0.0 / Esprima 4.0.1 (BSD-2-Clause)
 
 Copyright JS Foundation and other contributors, https://js.foundation/