guardvibe 3.14.0 → 3.14.2

package/CHANGELOG.md

@@ -5,6 +5,22 @@ All notable changes to GuardVibe are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [3.14.2] - 2026-06-08
+
+### Fixed — VG964 false positives on App Router route segments (442 rules / 37 tools)
+- **VG964 (Server-Only Module Missing) no longer fires on App Router route-segment files** — `page` / `layout` / `route` / `template` / `loading` / `error` / etc. under `app/` (without `"use client"`). These are React Server Components that Next renders as route entrypoints; they are never imported into a client bundle, so they're server-only by default and don't need the `server-only` package. The rule still targets shared modules that could be imported client-side (and Pages Router files, which do ship to the client).
+- Found by a corpus FP audit. Validated via a clean old-vs-new diff: **VG964 14 → 5, all 9 removed are genuine App Router route segments** (e.g. payload preview routes, plane `layout.tsx`, unkey settings pages), **0 true positives lost**, 0 drift in any other rule. 4 tests. No rule or tool changes (442 / 37).
+
+Gate green (build / lint / test / self-audit PASS / A / 0).
+
+## [3.14.1] - 2026-06-08
+
+### Fixed — release pipeline resilience (442 rules / 37 tools)
+- The v3.14.0 npm publish succeeded but the MCP-registry step hit a transient **504 Gateway Time-out** from registry.modelcontextprotocol.io, leaving the registry one version behind. This patch re-publishes to bring npm + the MCP registry back in sync.
+- **Hardened `publish.yml`:** the npm publish step is now idempotent (skips if the version already exists), so a transient MCP-registry outage can be retried via `gh run rerun --failed` without failing on a duplicate npm publish. No rule, tool, or behavior changes (442 / 37).
+
+Gate green (build / lint / test / self-audit PASS / A / 0).
+
 ## [3.14.0] - 2026-06-08
 
 ### Added — intel maintenance: Vite / launch-editor dev-server RCE (441 → 442 rules / 37 tools)

package/build/tools/check-code.js

@@ -660,6 +660,20 @@ export function analyzeCode(code, language, framework, filePath, configDir, rule
             if (hasUseClient || hasReactStateHooks)
                 continue;
         }
+        // VG964 (Server-Only Module Missing): App Router route-segment files
+        // (page/layout/route/template/… without "use client") are server components —
+        // route entrypoints Next renders server-side that are NEVER imported into a
+        // client bundle, so they're server-only by default and don't need the
+        // `server-only` package. The rule targets SHARED modules that could be imported
+        // client-side; skip RSC route segments to avoid false positives. Only `app/`
+        // (App Router) qualifies — Pages Router page files DO ship to the client.
+        if (rule.id === "VG964" && filePath) {
+            const fp = filePath.replace(/\\/g, "/");
+            if (/(?:^|\/)app\//.test(fp) &&
+                /(?:^|\/)(?:page|layout|route|template|default|loading|error|not-found|global-error|head)\.(?:tsx?|jsx?)$/.test(fp)) {
+                continue;
+            }
+        }
         // Skip SQL injection rules in schema/migration .sql files (DDL, not user input)
         if (rule.id === "VG543" && (isMigrationFile || isSqlSchemaFile))
             continue;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "guardvibe",
-  "version": "3.14.0",
+  "version": "3.14.2",
   "mcpName": "io.github.goklab/guardvibe",
   "description": "Security infrastructure your AI can't be — deterministic, current past your model's training cutoff, whole-repo-aware, author-independent. Security MCP for vibe coding. 442 rules, 37 tools, CLI + doctor. Host security, auth coverage mapping, LLM-powered deep scan (IDOR/business logic), taint analysis. 71 CVE rules refreshed daily from GHSA/OSV/CISA KEV — Vite dev-server RCE, React Router 7 cluster, DOMPurify XSS, Better Auth bypass, Miasma @redhat-cloud-services compromise, Next.js May 2026 13-advisory cluster, Drizzle/MikroORM/Kysely SQL injection, Axios proxy-auth redirect leak, Hono setCookie attribute injection, Clerk SSRF, tRPC prototype pollution, @tanstack supply-chain, node-ipc protestware, OpenClaude sandbox bypass, plus the full AI-generated stack (Supabase, Stripe, Prisma, Hono, GraphQL, Convex, Turso, Uploadthing, AI SDK). 68 AI-native rules including OWASP MCP Top 10 tool-description prompt injection (VG1068), model-controlled sandbox-disable flag detection (VG1063), Session messenger exfil endpoint IOC (VG1075), and CI/CD supply-chain hardening (VG1070 npm --expect-provenance / --ignore-scripts enforcement).",
   "type": "module",