herozion 2.0.16 → 2.0.19

package/bin/checksums.json

@@ -1,8 +1,8 @@
 {
   "_comment": "SHA-256 hashes for each platform binary. Auto-generated in CI from release CHECKSUMS.sha256. DO NOT edit manually.",
-  "_version": "2.0.16",
-  "herozion-linux-amd64": "a6f14d840c17e335bb1d34edb88ee9aad688db73595de8a0573091538bfc8796",
-  "herozion-macos-amd64.tar.gz": "d2d99b9a51ccfcd533b8c7e62af924886ae5c090772a3ff43dbbed26ea3d9e02",
-  "herozion-macos-arm64.tar.gz": "c29772a2ef54953e5a86a5dafb2e06cf456e5cc1765ff506f243d4d171ffe499",
-  "herozion-windows-amd64.exe": "711328645a1e692e7f63e6eb86d77b0da8b4797c64e2ed743abf3fa7cc100d88"
+  "_version": "2.0.19",
+  "herozion-linux-amd64": "53779092e01cbe8352a8ff7e07f04dacc9cc9cacc9f0f867f88c1c6269b965f3",
+  "herozion-macos-amd64.tar.gz": "b74743df87d166b90245833dad35179651e4ad56db5b9fc1f65a6a539b6f2c98",
+  "herozion-macos-arm64.tar.gz": "7b019d734c5e5581c10c757fea559e2b759378e993eac829125e1ea0fb457aea",
+  "herozion-windows-amd64.exe": "c4925276768ea34fd6b92d96bb9d9fb59a9d623cb6837ff53fc37a0bc765272f"
 }

package/install.js

@@ -268,9 +268,12 @@ async function main() {
   if (fs.existsSync(bundledChecksumsPath)) {
     try {
       const bundled = JSON.parse(fs.readFileSync(bundledChecksumsPath, "utf8"));
-      bundledHash = (bundled[binaryName] || "").toLowerCase().trim();
+      bundledHash = bundledHashFor(bundled, binaryName, VERSION);
       if (!bundledHash) {
-        console.warn(`herozion: WARNING — no bundled hash entry for ${binaryName}.`);
+        console.warn(
+          `herozion: WARNING — no bundled hash entry for ${binaryName} v${VERSION} ` +
+          `(checksums.json is for v${bundled._version || "?"}).`
+        );
       }
     } catch (parseErr) {
       console.warn(`herozion: WARNING — invalid checksums.json: ${parseErr.message}`);
@@ -350,6 +353,18 @@ function parseRemoteChecksum(checksumData, binaryName) {
  * A remote mismatch always rejects the binary. A failure to fetch the remote
  * file is fatal only when the bundled hash did not already match.
  */
+/**
+ * Bundled hash for ``binaryName``, only when ``checksums.json`` was generated
+ * for this package version. A file left from another version (a source
+ * checkout of the tag, a stale build) must not be used as the trust anchor:
+ * its hashes belong to other binaries. Empty string → remote verification.
+ */
+function bundledHashFor(bundled, binaryName, version) {
+  if (!bundled || typeof bundled !== "object") return "";
+  if (String(bundled._version || "") !== String(version)) return "";
+  return String(bundled[binaryName] || "").toLowerCase().trim();
+}
+
 async function verifyChecksums({ actualHash, bundledHash, binaryName, readRemoteChecksums }) {
   let bundledVerified = false;
   let remoteVerified = false;
@@ -401,6 +416,7 @@ if (require.main === module) {
 
 module.exports = {
   _isRedirect,
+  bundledHashFor,
   download,
   downloadText,
   parseRemoteChecksum,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "herozion",
-  "version": "2.0.16",
+  "version": "2.0.19",
   "description": "Security audit and performance analysis CLI tool for developers",
   "keywords": [
     "security",
@@ -33,7 +33,7 @@
     "preuninstall": "node uninstall.js"
   },
   "engines": {
-    "node": ">=16.0.0"
+    "node": ">=22"
   },
   "publishConfig": {
     "access": "public"