@tdk-landscape/tdk-cli-core 1.3.129 → 1.3.131

package/CHANGELOG.md

@@ -4,6 +4,26 @@ Notable changes to the `tdk` CLI. Versions match [npm](https://www.npmjs.com/pac
 
 ## Unreleased
 
+## 1.3.130 (2026-10-08)
+
+- Releases now come with a signed checksum list: `checksums.txt.sigstore.json` (keyless Sigstore signature from the release workflow) is attached next to the binaries in [tdk-cli-releases](https://github.com/tdk-landscape/tdk-cli-releases/releases) and to a release with the same tag here. How to verify is in [docs/security.md](docs/security.md#releases). The binaries themselves are not signed individually (#869, #840).
+- `tdk resource` for a Python backend now writes `pytest==9.0.3` in the generated `pyproject.toml` (was 8.3.4, affected by GHSA-6w46-j5rx-g56g) (#867).
+- Examples: bumped past open Dependabot alerts: puma 7.2.1 (Sinatra), NestJS 11.1.18, drizzle-orm 0.45.2 and pytest 9.0.3 (#867).
+- Supply chain: every checked-in Dockerfile base image is pinned to a digest (#865).
+- Tests: a property-based fuzz test for the `service.json` line-break guard runs on every pull request (#866).
+- Docs: the README shows the OpenSSF Best Practices badge (#868).
+
+## 1.3.129 (2026-10-08)
+
+- Security policy: `SECURITY.md` now states acknowledgement, assessment, fix and disclosure timelines (#842).
+- Dependencies: four vulnerable transitive JavaScript dependencies bumped in `bun.lock` and `cli/pnpm-lock.yaml` (shell-quote, smol-toml, source-map-js, ws), and the BYO fiber (v2.52.15) and starlette (1.x) examples moved past known advisories (#843, #844, #845).
+- Supply chain: every GitHub Action is pinned to a commit SHA (#864).
+- Docs: a guide for testing webhooks locally (#846).
+
+## 1.3.128 (2026-10-08)
+
+- Internal: the skills-sync workflow gets `contents: write` only on the job that pushes, not workflow-wide (#841). No change to the CLI.
+
 ## 1.3.127 (2026-10-08)
 
 - Security hardening flagged by Socket (#826). The npm package no longer includes `ext/ide-components/code_executor/server.py`, a browser terminal that ran client-supplied commands through a shell. `tdk` and the Tilt engine never started it. The other IDE components are unchanged. `tdk doctor` now single-quotes the registry URL and container name it passes to `curl` and `docker logs`, so a value such as `$(...)` can no longer run a command.

package/README.md

@@ -9,6 +9,7 @@
 [![Example apps E2E](https://github.com/tdk-landscape/tdk-cli-core/actions/workflows/examples-e2e.yml/badge.svg?branch=main)](https://github.com/tdk-landscape/tdk-cli-core/actions/workflows/examples-e2e.yml)
 [![CodeQL](https://github.com/tdk-landscape/tdk-cli-core/actions/workflows/codeql.yml/badge.svg?branch=main)](https://github.com/tdk-landscape/tdk-cli-core/security/code-scanning)
 [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/tdk-landscape/tdk-cli-core/badge)](https://scorecard.dev/viewer/?uri=github.com/tdk-landscape/tdk-cli-core)
+[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/15310/badge)](https://www.bestpractices.dev/projects/15310)
 [![Known Vulnerabilities](https://snyk.io/test/github/tdk-landscape/tdk-cli-core/badge.svg)](https://snyk.io/test/github/tdk-landscape/tdk-cli-core)
 [![Socket Badge](https://badge.socket.dev/npm/package/@tdk-landscape/tdk-cli-core/latest)](https://socket.dev/npm/package/@tdk-landscape/tdk-cli-core/overview)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)

package/cli/bin/tdk.js

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 
+import { existsSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 
@@ -26,7 +27,12 @@ if (nodeTooOld(process.versions.node)) {
   process.exit(1);
 }
 
-const cliPath = join(__dirname, "..", "dist", "cli.js");
+// dist-bundle/ (ink/react/chalk inlined) exists only in a packed npm package;
+// a git checkout runs the committed dist/ instead.
+const bundledCliPath = join(__dirname, "..", "dist-bundle", "cli.js");
+const cliPath = existsSync(bundledCliPath)
+  ? bundledCliPath
+  : join(__dirname, "..", "dist", "cli.js");
 
 import(pathToFileURL(cliPath).href).catch((err) => {
   console.error("Failed to start TDK:", err);

package/cli/dist/backend-languages/python.js

@@ -20,7 +20,7 @@ dependencies = [
 
 [project.optional-dependencies]
 dev = [
-  "pytest==8.3.4",
+  "pytest==9.0.3",
   "httpx==0.28.1",
 ]
 

package/cli/dist-bundle/chunk-6EA4DGCY.js

@@ -0,0 +1,2 @@
+import{createRequire as __tdkRequire}from'node:module';const require=__tdkRequire(import.meta.url);
+var g=Object.create;var e=Object.defineProperty;var h=Object.getOwnPropertyDescriptor;var i=Object.getOwnPropertyNames;var j=Object.getPrototypeOf,k=Object.prototype.hasOwnProperty;var m=(a=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(a,{get:(b,c)=>(typeof require<"u"?require:b)[c]}):a)(function(a){if(typeof require<"u")return require.apply(this,arguments);throw Error('Dynamic require of "'+a+'" is not supported')});var n=(a,b)=>()=>{try{return b||a((b={exports:{}}).exports,b),b.exports}catch(c){throw b=0,c}},o=(a,b)=>{for(var c in b)e(a,c,{get:b[c],enumerable:!0})},l=(a,b,c,f)=>{if(b&&typeof b=="object"||typeof b=="function")for(let d of i(b))!k.call(a,d)&&d!==c&&e(a,d,{get:()=>b[d],enumerable:!(f=h(b,d))||f.enumerable});return a};var p=(a,b,c)=>(c=a!=null?g(j(a)):{},l(b||!a||!a.__esModule?e(c,"default",{value:a,enumerable:!0}):c,a));export{m as a,n as b,o as c,p as d};