@tantainnovative/ndpr-toolkit 3.10.5 → 3.10.6
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +41 -0
- package/README.md +1 -1
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -2,6 +2,47 @@
|
|
|
2
2
|
|
|
3
3
|
All notable changes to this project will be documented in this file. See [commit-and-tag-version](https://github.com/absolute-version/commit-and-tag-version) for commit guidelines.
|
|
4
4
|
|
|
5
|
+
## [3.10.6](https://github.com/mr-tanta/ndpr-toolkit/compare/v3.10.5...v3.10.6) (2026-05-27)
|
|
6
|
+
|
|
7
|
+
Release 2 of 6 on the post-audit roadmap. CI / repo plumbing only — zero `dist/` changes, zero behaviour changes for consumers.
|
|
8
|
+
|
|
9
|
+
### CI workflows hardened
|
|
10
|
+
|
|
11
|
+
- **`ci.yml`** — synced the `Verify entry points` loop with `publish.yml` (17 → 22 entries). Pre-3.10.6 a PR could pass CI while failing the publish workflow at release time. Both now check the same 22 entries plus `dist/styles.css`. Also added the **`verify:tarball` step**: the same ESM + CJS + TS resolution gate that runs in `publish.yml` now runs on every PR, so the 3.8.0–3.10.2 missing-exports class of bug can never reach a tag again.
|
|
12
|
+
- **`concurrency:` groups + `timeout-minutes:`** added to all three workflows.
|
|
13
|
+
- **`publish.yml`** — `npm install -g npm@11` (was `npm@latest`). Pin deliberately so a future npm major can't break release day.
|
|
14
|
+
- **`nextjs.yml`** — moved `id-token: write` from workflow-level to the `deploy` job only (least privilege). Added a docs-site typecheck step on PR builds, closing the "docs site never typechecks" gap. PRs build without deploying.
|
|
15
|
+
|
|
16
|
+
### New workflows
|
|
17
|
+
|
|
18
|
+
- **`.github/workflows/codeql.yml`** — CodeQL SAST on push + PR + weekly cron.
|
|
19
|
+
- **`.github/dependabot.yml`** — weekly automated PRs for `github-actions` + `npm`, grouped.
|
|
20
|
+
|
|
21
|
+
### Governance docs
|
|
22
|
+
|
|
23
|
+
- `SECURITY.md`, `CODE_OF_CONDUCT.md`, `.github/FUNDING.yml`, `CODEOWNERS`, `.github/PULL_REQUEST_TEMPLATE.md`, `.github/ISSUE_TEMPLATE/{bug_report,feature_request,config}.{md,yml}`.
|
|
24
|
+
|
|
25
|
+
### Example apps hygiene
|
|
26
|
+
|
|
27
|
+
- `engines.node: >=20.0.0` added to all **14** example `package.json` files (was 2 of 14).
|
|
28
|
+
- `.gitignore` added to `examples/ssr/{remix,astro}`. `examples/ssr/remix/public/.gitkeep` so the conventional dir exists.
|
|
29
|
+
- `examples/dsr-backend-prod/README.md` — added a "Switching to PostgreSQL for production" subsection with the schema diff.
|
|
30
|
+
|
|
31
|
+
### README
|
|
32
|
+
|
|
33
|
+
- Tests badge swapped from a static `tests-1192 passing` shield to a live `CI` badge driven by the actual workflow status.
|
|
34
|
+
|
|
35
|
+
### Known follow-up
|
|
36
|
+
|
|
37
|
+
- The plan called for switching all three workflows to `--frozen-lockfile`. Defer: significant pre-existing lockfile drift (next 16.2.2 → 16.2.6, the docs-site self-dep, `@phosphor-icons/react` addition all pre-date proper lockfile maintenance). Tightening alongside the lockfile regeneration warrants its own dedicated release rather than risking unrelated breakage here.
|
|
38
|
+
|
|
39
|
+
### Verification
|
|
40
|
+
|
|
41
|
+
- Workflow YAML lints; CI green on the new entry-point loop and verify-tarball step.
|
|
42
|
+
- Jest: 1212 / 1212 passing (no functional changes).
|
|
43
|
+
- `tsc --noEmit -p tsconfig.json` clean for the docs site.
|
|
44
|
+
- `pnpm verify:tarball` clean across all 22 subpaths.
|
|
45
|
+
|
|
5
46
|
## [3.10.5](https://github.com/mr-tanta/ndpr-toolkit/compare/v3.10.4...v3.10.5) (2026-05-27)
|
|
6
47
|
|
|
7
48
|
First of six releases on the post-audit roadmap (3.10.5 → 3.10.6 → 3.11.0 → 3.12.0 → 3.13.0 → 4.0.0). This patch covers the "real bugs consumers actively hit" tier — no API changes observable to consumers.
|
package/README.md
CHANGED
|
@@ -6,7 +6,7 @@
|
|
|
6
6
|
[](https://www.npmjs.com/package/@tantainnovative/ndpr-toolkit)
|
|
7
7
|
[](https://opensource.org/licenses/MIT)
|
|
8
8
|
[](https://www.typescriptlang.org/)
|
|
9
|
-
[](https://github.com/mr-tanta/ndpr-toolkit/actions/workflows/ci.yml)
|
|
10
10
|
[](https://bundlephobia.com/package/@tantainnovative/ndpr-toolkit)
|
|
11
11
|
|
|
12
12
|
v3 ships **zero-config presets**, **pluggable storage adapters**, **compound components**, and a **compliance score engine** — eight production-ready modules covering consent, data subject rights, DPIA, breach notification, privacy policies, lawful basis, cross-border transfers, and ROPA.
|
package/package.json
CHANGED