@yottameta/yotta-code-quality 0.4.0 → 0.4.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +4 -0
- package/SKILL.md +1 -1
- package/package.json +1 -1
- package/references/editorial-extensions.md +1 -1
package/CHANGELOG.md
CHANGED
package/SKILL.md
CHANGED
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@yottameta/yotta-code-quality",
|
|
3
|
-
"version": "0.4.
|
|
3
|
+
"version": "0.4.1",
|
|
4
4
|
"description": "Pair-style code quality reviewer: twelve book-grounded decay risks (R1-R6, T1-T6) plus release-safety and first-paint UX checks; Iron Law findings (Symptom -> Source -> Consequence -> Remedy) and 0-100 Health Score.",
|
|
5
5
|
"license": "MIT",
|
|
6
6
|
"keywords": [
|
|
@@ -13,7 +13,7 @@ For Source line prefer `Editorial — Release Safety` / `Editorial — First-pai
|
|
|
13
13
|
- Updater / installer: signature verification skipped, missing pubkey, artifacts unsigned while “auto-update” is on.
|
|
14
14
|
- Production DevTools / debug features left enabled in release builds.
|
|
15
15
|
- CSP `null` / wildly open `connect-src` / `unsafe-eval` in production without documented need.
|
|
16
|
-
-
|
|
16
|
+
- Remote download pipelines that pass content directly to a shell in docs/scripts aimed at end users.
|
|
17
17
|
- Dependency or plugin allowlists that effectively disable sandboxing for convenience.
|
|
18
18
|
|
|
19
19
|
### Severity guide
|