fullshield 1.0.0 → 1.0.1

package/CHANGELOG.md

@@ -2,6 +2,62 @@
 
 All notable changes to FullShield are documented here.
 
+## 1.0.1 — 2026-10-20
+
+Documentation-only release. Scanner behavior, default `scan --json` output, and exit
+codes are unchanged. `default-scan-diff` against 1.0.0 is empty.
+
+### Contract correction (docs/stability.md)
+
+1.0.0's stability.md listed values in Stable that only experimental flags produce.
+That was a documentation error. This release moves them to Experimental.
+
+Moved from Stable to Experimental:
+- `Finding.source` values `ai`, `user-rule`, `npm-audit`, `semgrep`, `osv-scanner`, `sarif`.
+- `Finding.suppressedBy` (`types`, `model:<package>`).
+- Error codes `FS-E005`–`FS-E009`, `FS-E012`–`FS-E016`.
+- Config keys `ai`, `sast.sources`, `sast.sanitizers`.
+
+Moved to Internal: `FS-E010`, `FS-E011` (contributor tooling only).
+
+Added to Stable (shipped and documented as stable since 0.1.0 or 0.2.0): `watch`, `edge`,
+`notify`, `doctor`, and the core `scan --json` finding fields.
+
+If you depended on a moved value, it still works in 1.0.1. It may change in a later minor.
+
+### Documentation
+
+- `CAPABILITIES.md` rewritten. The 1.0.0 file described 0.1.1 and carried finding
+  counts that no longer match. It now links to generated files instead of copying numbers.
+- `docs/demo.md` and `BENCHMARK.md` regenerated from runs at 1.0.1.
+- `COMPARISON.md` is marked not citable until the Semgrep run is re-checked.
+- History notes moved to `docs/history/`.
+- Corrected stale lines in `errors.md`, `QUALITY.md`, `priority.md`, `NOISE-REPORT.md`,
+  and `CONTRIBUTING.md`.
+
+### 1.0.0 notes corrected
+
+- The 0.2.0 entry said 0.3.0 and 0.4.0 were not tagged. That was true when written.
+  Both were tagged later.
+- 1.0.0 said Phases 52 and 78 were "merged locally". Both are in the `v1.0.0` commit
+  `d654c8b6f155bec88b2327a62402f0b35feb277d`, which contains `5a0d006` (phase 52) and
+  `4966d8b` (phase 78).
+- Phase 77 is in 1.0.0 as `scripts/realworld-diff.mjs`. It is a dev gate and has no scan flag.
+- Phase 81 is in 1.0.0 behind `FULLSHIELD_EXPERIMENTAL_MODELS`.
+- Phase 82 is in 1.0.0 behind `FULLSHIELD_EXPERIMENTAL_SECRET_CHECK`.
+- Phase 84 is in 1.0.0 behind `FULLSHIELD_EXPERIMENTAL_PRIORITY`.
+- Phase 89 is in 1.0.0 behind `FULLSHIELD_EXPERIMENTAL_SPDX`.
+- Phase 92 is in 1.0.0 as issue forms, companion-tool docs, and required check names. It has no scan flag.
+- The Phase 75 and Phase 51 default-scan diffs were empty on every bench app. That shows
+  no regression. It does not show either change finds anything on those apps.
+
+### Release check
+
+1.0.0 was tagged before the six-job matrix was confirmed green on `main`.
+The six required checks in `docs/branch-protection.md` passed on pull request #18:
+https://github.com/kathanp/fullshield/actions/runs/39514123297
+1.0.1 is tagged only after those checks pass on `main`.
+
 ## 1.0.0 — 2026-10-20
 
 1.0.0 freezes the stable CLI, config keys, exit codes, error codes `FS-E000`–`FS-E016`, and the library exports in `api/fullshield.api.json`. The promise is [docs/stability.md](docs/stability.md).
@@ -189,7 +245,7 @@ Off unless `FULLSHIELD_EXPERIMENTAL_DIFF=1` or `fullshield diff --experimental-d
 
 ## 0.2.0 — 2026-10-16
 
-Phases 36–45 ship in this version. `0.3.0` and `0.4.0` were not tagged.
+Phases 36–45 ship in this version. (At the time of writing, `0.3.0` and `0.4.0` were not yet tagged. Both were tagged later.)
 
 ### Phase 36 — provenance and semver
 

package/README.md

@@ -1,6 +1,6 @@
 # FullShield
 
-**v1.0.0.** One install for Node.js/TypeScript backends: detect → classify → report → notify → fix → gate (CI `--fail-on` + runtime monitor). It does not stop attacks by itself.
+**v1.0.1.** One install for Node.js/TypeScript backends: detect → classify → report → notify → fix → gate (CI `--fail-on` + runtime monitor). It does not stop attacks by itself.
 
 **Headline: dependency reachability.** A lockfile CVE is not the same as an unused package. FullShield classifies each OSV hit as `reachable` (imported and called), `imported-not-called` (−1), `reachable-via-dependency` (lockfile path from an imported direct dep — **severity kept**, path shown, e.g. `express > body-parser > qs`), `not-imported` (−2, only when no such path exists), or `reachability-unknown` (severity kept) when the lockfile format has no parsed dependency edges. DevDependency-only vulns are `info` with a `dev-only` note unless production sources import the package. Pair it with `fullshield sbom --format cyclonedx`.
 
@@ -89,7 +89,7 @@ These fixtures are self-authored. Numeric SQL (`WHERE id = ` + input), ORM raw-q
 
 In-scope public-bench patterns we still do not claim (one line each):
 
-- Swig `{{firstName}}` in `.html` — XSS only if autoescape is off in another file; we flag `autoescape: false`, not the template line.
+- Swig `{{ name }}` is `SAST-XSS-001` only when the view engine is Swig and that name is tainted from `req` or a database read. `{{csrftoken}}` and unrendered templates are not findings. Handlebars `{{ }}` stays unflagged. `autoescape: false` is still a finding.
 - Juice Shop track-order XSS — server returns `res.json`; we do not treat JSON fields as HTML sinks.
 - Juice Shop `url.includes(allowedUrl)` — weak allowlist helper is not a redirect sink; we flag `res.redirect(tainted)`.
 - Juice Shop `{ _id: req.body.id }` — flagged as `SAST-NOSQLI-001` (medium) unless coerced (`String()`/`Number()`/`Boolean()`), schema-validated, or mongo-sanitize is applied. Same for goof `User.find({ password: req.body.password })`.
@@ -137,7 +137,7 @@ app.use(shieldGuard({ mode: 'monitor', authRoutes: ['/login'] }));
 
 **Experimental CI reports (off by default):** `FULLSHIELD_EXPERIMENTAL_CI_REPORTS=1` or `scan --experimental-ci-reports`, then `--github-annotations`, `--junit`, and `--gitlab`. Default console and `--json` output stay the same. Critical and high become GitHub `error` commands and JUnit failures. Medium is a GitHub warning and a JUnit failure. Low and info are GitHub notices and JUnit skips. GitLab severities are info, minor, major, critical, and blocker.
 
-**Experimental scan diff (off by default):** `FULLSHIELD_EXPERIMENTAL_DIFF=1` or `fullshield diff --experimental-diff <before.json> <after.json>`. Compares two `scan --json` files. The match ignores the line number. It does not scan and does not decide which findings are real. Added findings at or above `--fail-on` (default high) exit 1. Baseline `suppressions` need an owner, a reason, and an expiry. The spec is [`docs/ADVANCED-SPEC.md`](docs/ADVANCED-SPEC.md).
+**Experimental scan diff (off by default):** `FULLSHIELD_EXPERIMENTAL_DIFF=1` or `fullshield diff --experimental-diff <before.json> <after.json>`. Compares two `scan --json` files. The match ignores the line number. It does not scan and does not decide which findings are real. Added findings at or above `--fail-on` (default high) exit 1. Baseline `suppressions` need an owner, a reason, and an expiry. The spec is [`docs/history/ADVANCED-SPEC.md`](docs/history/ADVANCED-SPEC.md).
 
 **Experimental ingest (off by default):** `FULLSHIELD_EXPERIMENTAL_INGEST=1` or `fullshield ingest --experimental-ingest <file...>`. Reads local SARIF 2.1.0, OSV-Scanner JSON, `npm audit --json`, and Semgrep JSON. It does not run those tools and does not fetch. Severity stays the tool's severity (`moderate` and Semgrep `WARNING` are stored as medium; the original token is `externalSeverity`). `fullshieldPriority` is not set.
 

package/models/index.json

@@ -1,5 +1,5 @@
 {
-  "fullshieldVersion": "1.0.0",
+  "fullshieldVersion": "1.0.1",
   "entries": [
     {
       "package": "express",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullshield",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "Full-cycle security scanner for Node.js/TypeScript backends: detect, classify, report, notify, fix, prevent.",
   "license": "MIT",
   "type": "module",
@@ -119,6 +119,6 @@
     "zod": "^4.6.7"
   },
   "knip": {
-    "ignore": ["test/fixtures/**"]
+    "ignore": ["test/fixtures/**", "scripts/doc-version-check.mjs"]
   }
 }