@wenathlan/devthink 1.1.5 → 1.1.7

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## 1.1.7 — Security remediation
+
+This release resolves the Trivy Dockerfile finding `DS-0026` by declaring an executable container health check that verifies the Bun-compiled DevThink CLI is available in the nonroot distroless runtime. The security workflow keeps its active Trivy, OSV, pnpm-audit and verified-secret gates; no scanner, severity threshold or release protection is weakened.
+
+| Area | Change |
+| --- | --- |
+| Container hardening | Adds a native `HEALTHCHECK` instruction that executes `devthink --help` without requiring a shell in the distroless runtime. |
+| Gateway reliability | Requests an operating-system-assigned loopback port by default, avoiding HTTP-client restricted ports during concurrent test execution in CI. |
+| Dependency review | Confirms the workbench audit has no known vulnerabilities at low, moderate, high or critical severity. |
+| Mobile dependency graph | Retains the `uuid` 11.1.1 override that removes the previously vulnerable transitive UUID version. |
+| Release metadata | Aligns the CLI, static workbench, mobile shell and browser extension on version 1.1.7. |
+
+## 1.1.6 — Mobile artifact activation
+
+This release corrects the mobile workflow's source detector for the JSON Capacitor configuration. Android development APK/AAB and iOS simulator application packaging now execute whenever the source is present.
+
 ## 1.1.5 — Minimal container runtime
 
 This release replaces the container runtime with a nonroot distroless compatibility image. The image contains only the compiled DevThink binary and its required C/C++ runtime libraries, reducing the operating-system package surface scanned before GHCR publication.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wenathlan/devthink",
-  "version": "1.1.5",
+  "version": "1.1.7",
   "description": "DevThink is an AI development workbench with provider-owned endpoints, normalized streaming, sessions, memory, an embedded gateway and a terminal/web interface.",
   "license": "MIT",
   "type": "module",

package/server.ts

@@ -185,7 +185,7 @@ async function route(request: IncomingMessage, response: ServerResponse, config:
 }
 
 function randomPort(): number {
-  return randomInt(1, 65_535);
+  return randomInt(49_152, 65_535);
 }
 
 function bind(server: Server, port: number): Promise<number> {
@@ -211,7 +211,7 @@ export async function startServer(options: ServerOptions): Promise<ServerHandle>
     route(request, response, options.config, paths).catch((error: unknown) => writeJson(response, 500, { error: error instanceof Error ? error.message : "Request failed." }, safeOrigin(request, options.config)));
   });
   server.setMaxListeners(0);
-  let port = options.port || randomPort();
+  let port = options.port ?? 0;
   let lastError: unknown;
   for (let attempt = 0; attempt < 10; attempt += 1) {
     try {