guardvibe 3.14.0 → 3.14.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +8 -0
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -5,6 +5,14 @@ All notable changes to GuardVibe are documented in this file.
|
|
|
5
5
|
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
|
|
6
6
|
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
|
7
7
|
|
|
8
|
+
## [3.14.1] - 2026-06-08
|
|
9
|
+
|
|
10
|
+
### Fixed — release pipeline resilience (442 rules / 37 tools)
|
|
11
|
+
- The v3.14.0 npm publish succeeded but the MCP-registry step hit a transient **504 Gateway Time-out** from registry.modelcontextprotocol.io, leaving the registry one version behind. This patch re-publishes to bring npm + the MCP registry back in sync.
|
|
12
|
+
- **Hardened `publish.yml`:** the npm publish step is now idempotent (skips if the version already exists), so a transient MCP-registry outage can be retried via `gh run rerun --failed` without failing on a duplicate npm publish. No rule, tool, or behavior changes (442 / 37).
|
|
13
|
+
|
|
14
|
+
Gate green (build / lint / test / self-audit PASS / A / 0).
|
|
15
|
+
|
|
8
16
|
## [3.14.0] - 2026-06-08
|
|
9
17
|
|
|
10
18
|
### Added — intel maintenance: Vite / launch-editor dev-server RCE (441 → 442 rules / 37 tools)
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "guardvibe",
|
|
3
|
-
"version": "3.14.
|
|
3
|
+
"version": "3.14.1",
|
|
4
4
|
"mcpName": "io.github.goklab/guardvibe",
|
|
5
5
|
"description": "Security infrastructure your AI can't be — deterministic, current past your model's training cutoff, whole-repo-aware, author-independent. Security MCP for vibe coding. 442 rules, 37 tools, CLI + doctor. Host security, auth coverage mapping, LLM-powered deep scan (IDOR/business logic), taint analysis. 71 CVE rules refreshed daily from GHSA/OSV/CISA KEV — Vite dev-server RCE, React Router 7 cluster, DOMPurify XSS, Better Auth bypass, Miasma @redhat-cloud-services compromise, Next.js May 2026 13-advisory cluster, Drizzle/MikroORM/Kysely SQL injection, Axios proxy-auth redirect leak, Hono setCookie attribute injection, Clerk SSRF, tRPC prototype pollution, @tanstack supply-chain, node-ipc protestware, OpenClaude sandbox bypass, plus the full AI-generated stack (Supabase, Stripe, Prisma, Hono, GraphQL, Convex, Turso, Uploadthing, AI SDK). 68 AI-native rules including OWASP MCP Top 10 tool-description prompt injection (VG1068), model-controlled sandbox-disable flag detection (VG1063), Session messenger exfil endpoint IOC (VG1075), and CI/CD supply-chain hardening (VG1070 npm --expect-provenance / --ignore-scripts enforcement).",
|
|
6
6
|
"type": "module",
|