@sythos/js_barcode_universal 1.5.9 → 1.5.10

package/README.md

@@ -112,8 +112,8 @@ The `unpkg` and `jsdelivr` fields point at the IIFE bundle, so a CDN needs no in
 
 ```html
 <script src="https://unpkg.com/@sythos/js_barcode_universal"></script>
-<script src="https://unpkg.com/@sythos/js_barcode_universal@1.5.9"></script>
-<script src="https://cdn.jsdelivr.net/npm/@sythos/js_barcode_universal@1.5.9"></script>
+<script src="https://unpkg.com/@sythos/js_barcode_universal@1.5.10"></script>
+<script src="https://cdn.jsdelivr.net/npm/@sythos/js_barcode_universal@1.5.10"></script>
 ```
 
 Pin the version for anything you ship; the unpinned form resolves to `latest` and will move under
@@ -656,6 +656,50 @@ and reports which backend actually drew.
 
 ---
 
+## Security automation
+
+The repository is covered by GitHub's configured [CodeQL default setup](https://github.com/Sythos/JS_Barcode_Universal/security/code-scanning)
+for JavaScript and TypeScript code-scanning analysis. GitHub manages the analysis schedule and
+the security-events upload; this avoids running a duplicate advanced workflow alongside the
+repository-level default setup.
+
+[Dependabot](.github/dependabot.yml) checks the development TypeScript toolchain and GitHub Actions
+references weekly. Updates are repository-development controls only; the published SDK remains
+zero-dependency at runtime.
+
+These security workflows report findings and propose maintenance updates. They do not replace
+review of barcode conformance, licensing, patent status or release attestations.
+
+---
+
+## Build provenance and artifact attestations
+
+The package publication workflow in [`.github/workflows/npm-publish.yml`](.github/workflows/npm-publish.yml)
+uses npm provenance when publishing to the public npm registry. npm provenance and GitHub Artifact
+Attestations are related but separate records:
+
+- **npm provenance** is issued by npm for a package publication and links the published package to
+  its source repository and trusted build workflow;
+- **GitHub Artifact Attestations** bind a build artifact, its digest and its build context to the
+  GitHub Actions workflow that produced it. They can be verified independently of the npm registry.
+
+The release-specific attestation workflow is expected at
+[`.github/workflows/release.yml`](.github/workflows/release.yml). Release assets must be verified
+against this repository and their exact local file contents:
+
+```sh
+gh attestation verify path/to/release-asset.tgz -R Sythos/JS_Barcode_Universal
+```
+
+The same command can be used for any other attested release asset by replacing the path. An
+attestation confirms build provenance; it is not an ISO barcode-conformance certificate, a patent
+clearance, or a guarantee that the implementation is vulnerability-free.
+
+Release automation validates the package version against the selected Git tag; it does not invent
+or increment versions by itself. The current release is `1.5.10`.
+
+---
+
 ## Licence
 
 MIT © 2026 Sythos (https://www.sythos.net). Every source file carries the header.

package/bundle/sythos-barcode.esm.js

@@ -1,5 +1,5 @@
 /*!
- * Sythos Barcode Suite v1.5.9
+ * Sythos Barcode Suite v1.5.10
  *
  * MIT License
  *
@@ -17554,7 +17554,7 @@ function decodeStrict(image, options) {
     return results[0];
 }
 /** Library version, matching package.json. */
-const VERSION = '1.5.9';
+const VERSION = '1.5.10';
 
 __exports.listFormats = listFormats;
 __exports.encode = encode;

package/bundle/sythos-barcode.js

@@ -1,5 +1,5 @@
 /*!
- * Sythos Barcode Suite v1.5.9
+ * Sythos Barcode Suite v1.5.10
  *
  * MIT License
  *
@@ -17555,7 +17555,7 @@ function decodeStrict(image, options) {
     return results[0];
 }
 /** Library version, matching package.json. */
-const VERSION = '1.5.9';
+const VERSION = '1.5.10';
 
 __exports.listFormats = listFormats;
 __exports.encode = encode;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sythos/js_barcode_universal",
-  "version": "1.5.9",
+  "version": "1.5.10",
   "description": "Read and write barcodes in JavaScript and TypeScript with zero runtime dependencies. TypeScript sources compile to the JavaScript runtime and bundles. QR Code, Micro QR, rMQR, FrameQR Code, Aztec Code and Rune, PDF417 variants, GS1 DataBar Omnidirectional/Truncated, EAN supplements and one-dimensional formats.",
   "author": {
     "name": "Sythos",

package/src/index.d.ts

@@ -360,4 +360,4 @@ export declare function decodeStrict(image: {
     height: number;
 }, options?: object): DecodeResult;
 /** Library version, matching package.json. */
-export declare const VERSION = "1.5.9";
+export declare const VERSION = "1.5.10";

package/src/index.js

@@ -779,4 +779,4 @@ export function decodeStrict(image, options) {
     return results[0];
 }
 /** Library version, matching package.json. */
-export const VERSION = '1.5.9';
+export const VERSION = '1.5.10';

package/src/ts/index.d.ts

@@ -360,4 +360,4 @@ export declare function decodeStrict(image: {
     height: number;
 }, options?: object): DecodeResult;
 /** Library version, matching package.json. */
-export declare const VERSION = "1.5.9";
+export declare const VERSION = "1.5.10";

package/src/ts/index.ts

@@ -787,4 +787,4 @@ export function decodeStrict(image, options) {
 }
 
 /** Library version, matching package.json. */
-export const VERSION = '1.5.9';
+export const VERSION = '1.5.10';