blitzstrike 2.4.0 → 2.4.4

package/CHANGELOG.md

@@ -5,6 +5,15 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.4] — 2026-09-14
+
+### Added — automated publishing via npm trusted publishing (OIDC)
+
+- New `.github/workflows/release.yml`: publishes to npm on push to `main`
+  (version-gated) using trusted publishing (OIDC) — no npm token, no 2FA.
+- Adds `--provenance` (SLSA attestation) so every release is verifiably built
+  from this repo. npm's bypass-2FA token deprecation no longer blocks releases.
+
 ## [2.4.0] — 2026-09-14
 
 ### Added — bulk tool installation (install the whole catalog at once)

package/ROADMAP.md

@@ -46,3 +46,10 @@ Blitz Strike is version 1.0. This is where it's headed.
 - Everything wired, nothing decorative. A feature that isn't exercised in the
   flow is removed.
 - License-safe. MIT/Apache-2.0 only for vendored data.
+
+## Release pipeline
+
+Publishing is automated via npm **trusted publishing (OIDC)** — see
+`.github/workflows/release.yml`. No npm token or 2FA is required; push to `main`
+with a bumped `package.json` version and the workflow publishes directly with
+SLSA provenance.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.0",
+  "version": "2.4.4",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {