fullshield 1.7.0 → 1.8.0

package/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 All notable changes to FullShield are documented here.
 
+## 1.8.0 — 2026-10-25
+
+### Fixes
+
+- Phase 529: a `package-lock.json`, `npm-shrinkwrap.json`, `pnpm-lock.yaml`, `yarn.lock`, or the same file in a workspace, that cannot be parsed does not abort the scan. Secrets, SAST, and config still run. A lockfile that parses keeps the same findings.
+- Phase 531: the dev installs of `express` and `@modelcontextprotocol/sdk` resolve `body-parser` at 1.20.9 and 2.4.0, outside GHSA-27r3-jxmh-p828. No new runtime dependency. The scanner does not open a server.
+
 ## 1.7.0 — 2026-10-25
 
 ### New/changed stable findings — may change CI results; use --update-baseline

package/README.md

@@ -1,6 +1,6 @@
 # FullShield
 
-**v1.7.0.** One install for Node.js/TypeScript backends: detect → classify → report → notify → fix → gate (CI `--fail-on` + runtime monitor). It does not stop attacks by itself.
+**v1.8.0.** One install for Node.js/TypeScript backends: detect → classify → report → notify → fix → gate (CI `--fail-on` + runtime monitor). It does not stop attacks by itself.
 
 **Headline: dependency reachability.** A lockfile CVE is not the same as an unused package. FullShield classifies each OSV hit as `reachable` (imported and called), `imported-not-called` (−1), `reachable-via-dependency` (lockfile path from an imported direct dep — **severity kept**, path shown, e.g. `express > body-parser > qs`), `not-imported` (−2, only when no such path exists), or `reachability-unknown` (severity kept) when the lockfile format has no parsed dependency edges. DevDependency-only vulns are `info` with a `dev-only` note unless production sources import the package. Pair it with `fullshield sbom --format cyclonedx`.
 
@@ -10,7 +10,7 @@ npx fullshield scan --json --fail-on high
 npx fullshield scan --sarif fullshield.sarif
 ```
 
-1.7.0 is the version of this tree. The stable contract is [docs/stability.md](docs/stability.md). The 1.0.1 release moved values that only experimental flags produce out of Stable. Experimental flags stay off unless you set them. Do not treat a scan as a penetration test. Reviewed recall for untouched apps is not published. The stored Next.js cold scan is 71.7 seconds, above the 60-second target.
+1.8.0 is the version of this tree. The stable contract is [docs/stability.md](docs/stability.md). The 1.0.1 release moved values that only experimental flags produce out of Stable. Experimental flags stay off unless you set them. Do not treat a scan as a penetration test. Reviewed recall for untouched apps is not published. The stored Next.js cold scan is 71.7 seconds, above the 60-second target.
 
 **Supported runtime is Node.js >= 22.13.** `package.json` `engines` and `doctor` enforce that floor. `node:sqlite` runs without `--experimental-sqlite` from 22.13.0 (the module is still experimental and is loaded only by history/confirm, not by `--import` register).
 

package/models/index.json

@@ -1,5 +1,5 @@
 {
-  "fullshieldVersion": "1.7.0",
+  "fullshieldVersion": "1.8.0",
   "entries": [
     {
       "package": "express",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullshield",
-  "version": "1.7.0",
+  "version": "1.8.0",
   "description": "Full-cycle security scanner for Node.js/TypeScript backends: detect, classify, report, notify, fix, prevent.",
   "license": "MIT",
   "type": "module",
@@ -104,7 +104,7 @@
   },
   "devDependencies": {
     "@eslint/js": "^9.14.0",
-    "@modelcontextprotocol/sdk": "^1.32.1",
+    "@modelcontextprotocol/sdk": "^1.32.2",
     "@types/node": "^22.9.0",
     "@vitest/coverage-v8": "^2.1.4",
     "eslint": "^9.14.0",
@@ -128,6 +128,11 @@
       "src/phases/p480.ts",
       "src/phases/p483.ts"
     ],
-    "ignore": ["test/fixtures/**", "scripts/doc-version-check.mjs", "scripts/autopilot/guard.mjs", "docs/current/guard.mjs"]
+    "ignore": [
+      "test/fixtures/**",
+      "scripts/doc-version-check.mjs",
+      "scripts/autopilot/guard.mjs",
+      "docs/current/guard.mjs"
+    ]
   }
 }