fullshield 3.4.1 → 3.4.2

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to FullShield are documented here.
 
+## 3.4.2 — 2026-10-29
+
+### Trust pages
+
+- Phase 570: the compatibility page claims only the six existing CI jobs. Package managers and frameworks are not claimed. The npm-audit page states no finding count. The stranger-check template is not a workflow. No company quote. No new command or flag.
+
 ## 3.4.1 — 2026-10-29
 
 ### Adoption

package/README.md

@@ -1,6 +1,6 @@
 # FullShield
 
-**v3.4.1.** One install for Node.js/TypeScript backends: detect → classify → report → notify → fix → gate (CI `--fail-on` + runtime monitor). It does not stop attacks by itself. Scan when you want with `npx fullshield scan`, or install an every-2-hours timer with `npx fullshield schedule install`.
+**v3.4.2.** One install for Node.js/TypeScript backends: detect → classify → report → notify → fix → gate (CI `--fail-on` + runtime monitor). It does not stop attacks by itself. Scan when you want with `npx fullshield scan`, or install an every-2-hours timer with `npx fullshield schedule install`.
 
 **Headline: dependency reachability.** A lockfile CVE is not the same as an unused package. FullShield classifies each OSV hit as `reachable` (imported and called), `imported-not-called` (−1), `reachable-via-dependency` (lockfile path from an imported direct dep — **severity kept**, path shown, e.g. `express > body-parser > qs`), `not-imported` (−2, only when no such path exists), or `reachability-unknown` (severity kept) when the lockfile format has no parsed dependency edges. DevDependency-only vulns are `info` with a `dev-only` note unless production sources import the package. Pair it with `fullshield sbom --format cyclonedx`.
 
@@ -10,16 +10,16 @@ npx fullshield scan --json --fail-on high
 npx fullshield scan --sarif fullshield.sarif
 ```
 
-3.4.1 is the version of this tree. Python and other languages are out of scope. `schedule install` writes `fullShieldReport/fullShieldReport_YYYYMMDD_HHMM.md` every 2 hours and keeps 60 reports. `scan` does not create that folder. The stable contract is [docs/stability.md](docs/stability.md). The 1.0.1 release moved values that only experimental flags produce out of Stable. Experimental flags stay off unless you set them. `init --tour`, `init --stack`, and `digest --file` need `FULLSHIELD_EXPERIMENTAL_ADOPT=1`. The tour writes no file. The digest reads a local file and does not fetch. See [docs/security-page.md](docs/security-page.md) and [docs/compare.md](docs/compare.md). Do not treat a scan as a penetration test. Reviewed recall for untouched apps is not published. From `bench/perf-v2.json` (`measured: true`, `label: unreviewed`), the stored Next.js cold p50 is 107.95 seconds — still above the 60-second target (target unmet). Default scans share one AST, run modules in parallel, and use lazy taint. Multi-workspace repos scan each workspace lockfile by default; single-package finding keys stay the same as 2.3.0.
+3.4.2 is the version of this tree. Python and other languages are out of scope. `schedule install` writes `fullShieldReport/fullShieldReport_YYYYMMDD_HHMM.md` every 2 hours and keeps 60 reports. `scan` does not create that folder. The stable contract is [docs/stability.md](docs/stability.md). The 1.0.1 release moved values that only experimental flags produce out of Stable. Experimental flags stay off unless you set them. `init --tour`, `init --stack`, and `digest --file` need `FULLSHIELD_EXPERIMENTAL_ADOPT=1`. The tour writes no file. The digest reads a local file and does not fetch. See [docs/security-page.md](docs/security-page.md), [docs/compare.md](docs/compare.md), [docs/compatibility.md](docs/compatibility.md), and [docs/vs-npm-audit.md](docs/vs-npm-audit.md). The compatibility page claims only the six existing CI jobs. Do not treat a scan as a penetration test. Reviewed recall for untouched apps is not published. From `bench/perf-v2.json` (`measured: true`, `label: unreviewed`), the stored Next.js cold p50 is 107.95 seconds — still above the 60-second target (target unmet). Default scans share one AST, run modules in parallel, and use lazy taint. Multi-workspace repos scan each workspace lockfile by default; single-package finding keys stay the same as 2.3.0.
 
 ## Verify in 60 seconds
 
 ```bash
 # fresh temp / empty cache is enough — no install-guard phones home
-npx fullshield@3.4.1 --version
+npx fullshield@3.4.2 --version
 ```
 
-Package page: [npmjs.com/package/fullshield](https://www.npmjs.com/package/fullshield). Release tag: [v3.4.1](https://github.com/kathanp/fullshield/releases/tag/v3.4.1). Publish stages with npm provenance (OIDC). After install, the stranger checks in the build spec (scan / json / sarif / fail-on / fix / init / sbom) are the post-publish gate — no Rekor/sigstore SaaS dependency in the CLI.
+Package page: [npmjs.com/package/fullshield](https://www.npmjs.com/package/fullshield). Release tag: [v3.4.2](https://github.com/kathanp/fullshield/releases/tag/v3.4.2). Publish stages with npm provenance (OIDC). After install, the stranger checks in the build spec (scan / json / sarif / fail-on / fix / init / sbom) are the post-publish gate — no Rekor/sigstore SaaS dependency in the CLI.
 
 ## GitHub Action
 
@@ -28,7 +28,7 @@ Copy `templates/action/` into your repo (or use `kathanp/fullshield-action` once
 ```yaml
 - uses: your-org/your-repo/.github/actions/fullshield@<commit-sha>
   with:
-    version: '3.4.1'
+    version: '3.4.2'
 ```
 
 Or run `npx fullshield init --recommended` to write `profile: "recommended"` and a workflow that calls `./templates/action`. The Action runs `fullshield scan`, uploads SARIF, and may cache the baseline. It does not post a pull-request comment, open issues, or phone home.

package/models/index.json

@@ -1,5 +1,5 @@
 {
-  "fullshieldVersion": "3.4.1",
+  "fullshieldVersion": "3.4.2",
   "entries": [
     {
       "package": "express",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullshield",
-  "version": "3.4.1",
+  "version": "3.4.2",
   "description": "Full-cycle security scanner for Node.js/TypeScript backends: detect, classify, report, notify, fix, prevent.",
   "license": "MIT",
   "type": "module",

package/templates/action/action.yml

@@ -45,7 +45,7 @@ runs:
       uses: actions/setup-node@v7
       with:
         node-version: '22'
-    - name: Install fullshield@3.4.1
+    - name: Install fullshield@3.4.2
       shell: bash
       run: npm install --global fullshield@${{ inputs.version }}
     - name: Cache FullShield baseline

package/templates/fullshield-bumps.yml

@@ -9,9 +9,9 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v7
-      - run: npx fullshield@3.4.1 bumps plan --from .fullshield/last-scan.json
+      - run: npx fullshield@3.4.2 bumps plan --from .fullshield/last-scan.json
         env:
           FULLSHIELD_EXPERIMENTAL_BUMP_PR: '1'
-      - run: npx fullshield@3.4.1 bumps open --from .fullshield/last-scan.json
+      - run: npx fullshield@3.4.2 bumps open --from .fullshield/last-scan.json
         env:
           FULLSHIELD_EXPERIMENTAL_BUMP_PR: '1'

package/templates/github-workflow-action.yml

@@ -15,7 +15,7 @@ jobs:
       # Example Marketplace ref once published: kathanp/fullshield-action@<sha>
       - uses: ./templates/action
         with:
-          version: '3.4.1'
+          version: '3.4.2'
           fail-on: high
           cache-baseline: 'true'
           upload-sarif: 'true'

package/templates/github-workflow-diff.yml

@@ -10,6 +10,6 @@ jobs:
       - uses: actions/checkout@v7
         with:
           fetch-depth: 0
-      - run: npx fullshield@3.4.1 scan --diff
+      - run: npx fullshield@3.4.2 scan --diff
         env:
           FULLSHIELD_EXPERIMENTAL_DIFFSCAN: '1'

package/templates/stranger-check.md

@@ -0,0 +1,14 @@
+# Stranger check
+
+Run these steps yourself after a release is on npm. This file is a template. It is not a GitHub workflow and it does not post a status.
+
+1. `npx fullshield@<version> --version`
+2. `npx fullshield@<version> scan` on a project you own
+3. `npx fullshield@<version> scan --json`
+4. `npx fullshield@<version> scan --sarif`
+5. `npx fullshield@<version> scan --fail-on high`
+6. `npx fullshield@<version> fix --dry-run`
+7. `npx fullshield@<version> init`
+8. `npx fullshield@<version> sbom`
+
+No company quote belongs in this file.