dsh-image-integrity 0.1.0 → 0.1.1

package/CHANGELOG.md

@@ -4,7 +4,13 @@ All notable changes to this project are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project
 adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [Unreleased]
+## [0.1.1] - 2026-11-08
+
+### Changed
+
+- Release-engineering refresh: CHANGELOG accuracy, package metadata and authors; no runtime changes.
+
+## [0.1.0] - 2026-11-08
 
 ### Fixed
 
@@ -28,8 +34,6 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
   the O(n²) comparison loop.
 - Test count is now 22; README/CHANGELOG list the new failure branches.
 
-## [0.1.0] - 2026-11-08
-
 First release: block-level image reuse detection.
 
 ### Added

package/SECURITY.md

@@ -0,0 +1,19 @@
+# Security policy
+
+## Supported versions
+
+The latest published `0.1.x` release of this package receives security fixes.
+
+## Reporting a vulnerability
+
+Please use GitHub's private vulnerability reporting (Security → Advisories) on
+the repository, or open a minimal issue asking for a private channel if
+advisories are unavailable. Do not include credentials, personal data or
+working exploits in a public issue.
+
+## Scope notes
+
+- This package performs local file analysis only unless its README documents a
+  network provider; when it does, only the documented hosts are contacted.
+- Inputs are treated as untrusted data: document text is never executed.
+- No secrets are read or written by the package.

package/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,10 @@
+# Third-party notices
+
+This package contains **no third-party runtime code**: `dependencies` is empty.
+
+Development-only tooling (TypeScript, Vitest, `@deepseek-ai/*` type packages and
+the shared `@perrylink/dsh-research-core` peer, when present) is not bundled and
+is not distributed in the published tarball.
+
+If that ever changes, the affected license texts must be added here before a
+release.

package/lib/version.d.ts

@@ -3,5 +3,5 @@
  * @module dsh-image-integrity/version
  */
 /** The package version. */
-export declare const VERSION = "0.1.0";
+export declare const VERSION = "0.1.1";
 //# sourceMappingURL=version.d.ts.map

package/lib/version.js

@@ -3,5 +3,5 @@
  * @module dsh-image-integrity/version
  */
 /** The package version. */
-export const VERSION = '0.1.0';
+export const VERSION = '0.1.1';
 //# sourceMappingURL=version.js.map

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "dsh-image-integrity",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Image integrity checks for DeepSeek Harness: zero-dependency 8-bit PNG decoding (grey/RGB/RGBA) with mean-threshold block fingerprints and NCC confirmation to find duplicated or mirrored regions inside one figure or shared between two figures, plus REP evidence and Markdown/SARIF reports. Finds reused pixels, not manipulation intent; JPEG is out of scope in v0.1.",
-  "author": "dsh-statcheck contributors",
+  "author": "PerryLink contributors",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/PerryLink/dsh-image-integrity.git"
@@ -29,7 +29,9 @@
     "CHANGELOG.md",
     "README.md",
     "README-zh.md",
-    "LICENSE"
+    "LICENSE",
+    "SECURITY.md",
+    "THIRD_PARTY_NOTICES.md"
   ],
   "sideEffects": false,
   "dsh": {

package/src/version.ts

@@ -4,4 +4,4 @@
  */
 
 /** The package version. */
-export const VERSION = '0.1.0'
+export const VERSION = '0.1.1'