bdo-cli 0.48.2 → 0.49.0

package/CHANGELOG.md

@@ -5,6 +5,43 @@ All notable changes to Bushido (bdo) will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.49.0] (2026-10-29)
+
+### Security
+
+- **Secret redaction covers far more forms.** What bdo stores locally
+  (tracking DB, tee recovery files, hook audit fields) is now masked for:
+  environment-style assignments whose name ends in a secret word
+  (`GITHUB_TOKEN=…`, `OPENAI_API_KEY=…`, `AWS_SECRET_ACCESS_KEY=…`) — the old
+  rule missed these because `_TOKEN` has no word boundary; passwords in URL
+  userinfo (`https://user:PASS@host`, `postgres://…`); secret-named flags with a
+  separate value (`--password X`, `--token X`); mysql `-pPASS` and
+  `curl -u user:PASS`; Cookie headers; Slack/Discord webhook URLs; AWS/Azure
+  signed-URL parameters; and Hugging Face, Docker Hub, DigitalOcean, PyPI,
+  SendGrid, Google OAuth and further GitLab token formats. A probe of 23
+  common forms went from 2 masked to all 23. Look-alikes are pinned as
+  untouched: `MAX_TOKENS=4096`, `GITHUB_TOKEN=$GH_TOKEN`, `--password-stdin`,
+  `--token-file`, `ssh://git@host:22`, `cargo test -p`, `docker run -p`,
+  mysql's `-P3306`. Values may be quoted and contain spaces
+  (`PASSWORD="my secret pass"`, `--password ' leading'`, `-p'a b'`,
+  `curl -u 'alice:a b'`, `my\ pass`): the whole value is masked and its quotes
+  kept, and a Cookie value containing quotes (`session="…"`) is masked whole.
+  Each rule now compiles only when its trigger substrings appear, so the
+  per-command cost dropped despite the larger rule set (e.g. ~0.2 ms for an
+  env token, ~0.005 ms for a command with no secret word, vs ~2.8 ms before).
+
+## [0.48.3] (2026-10-27)
+
+### Security
+
+- **sha2 0.10 → 0.11**, which moves `block-buffer` from 0.10.4 to 0.12.1 and
+  fixes GHSA-qwgh-2vcv-g2f7 (a caught panic inside a compression callback
+  could corrupt the buffer position; not reachable from bdo, which never
+  hashes inside `catch_unwind`). Found by an OSV scan; it has no RustSec ID
+  yet, so `cargo audit` did not report it. Hashes are unchanged — the three
+  call sites now share one `sha256_hex` helper pinned by FIPS test vectors,
+  so stored hook-integrity, trust and device hashes stay valid.
+
 ## [0.48.2] (2026-10-25)
 
 ### Security

package/README.md

@@ -119,7 +119,7 @@ gh attestation verify "$(brew --cache bushido)" --repo tedorigawa001/TokenReduct
 ### Verify Installation
 
 ```bash
-bdo --version   # Should show "bdo 0.48.2"
+bdo --version   # Should show "bdo 0.49.0"
 bdo gain        # Should show token savings stats
 ```
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "artifactDownloadUrls": [
-    "https://github.com/tedorigawa001/TokenReductionTool-BDO/releases/download/v0.48.2"
+    "https://github.com/tedorigawa001/TokenReductionTool-BDO/releases/download/v0.49.0"
   ],
   "author": "Patrick Szymkowiak",
   "bin": {
@@ -91,7 +91,7 @@
       "zipExt": ".tar.xz"
     }
   },
-  "version": "0.48.2",
+  "version": "0.49.0",
   "volta": {
     "node": "18.14.1",
     "npm": "9.5.0"