nsauditor-ai 0.2.5 → 0.2.6

package/README.md

@@ -17,7 +17,9 @@ NSAuditor AI is the open-source core of a privacy-first security intelligence pl
 
 ## What's New
 
-**Latest: CE 0.2.5 + Enterprise 0.19.0** (June 2026) — paired pin for **EE 0.19.0** "No silent false-clean": the largest false-clean-class closure since the framework cycles — an un-scanned cloud region, a denied API call, or a logging-but-not-delivering trail can no longer read CLEAN at either the compliance verdict or the MCP transport. The shared `forEachRegion` now emits a per-region evidence-gap for every errored/access-denied AWS region (with class-O routing that fail-closes exactly that source's native attested controls across all six frameworks), plus four swallow→gap retrofits (1150 SQS/SNS, 1022 Azure storage, 1200 GuardDuty, 1040 CloudTrail delivery-failure). It also fixes two air-gapped/IAM criticals from the Mythos architecture review (the offline CVE matcher now fails-closed on distro/epoch/build-suffixed package versions; plugin 1110 keeps HIGH on the AWS-default root-delegation KMS key policy) and stops the AI-enrichment prompt from leaking the scan target (public IP/hostname/MAC/secrets) to the external LLM. Plugin count UNCHANGED at 28; all six coverage matrices UNCHANGED; CE has no code change (paired pin).
+**Latest: CE 0.2.6 + Enterprise 0.19.1** (June 2026) — paired pin for **EE 0.19.1** "Confirmed false-negative batch": seven gauntlet-confirmed Tier-B false-negatives across the Pro/Enterprise cloud auditors, each TDD'd and independently adversarially reviewed — AWS IAM prefix-glob privilege-escalation + access-key hygiene dead-code (1030); a wildcard-Principal SQS queue-policy audit at parity with SNS (1150); air-gapped KMS `CreateGrant`/`GenerateDataKey` effective-decrypt (1130); versioned-bucket noncurrent-version disposal via `GetBucketVersioning` (1120); deprecated Lambda runtimes (`provided` AL1) + a no-more-allowlist-fail-open runtime check (1080); GCP OIDC-impersonation / WIF-provider admin-equivalence (1025); and VPC-endpoint sensitive-action matching by service namespace (1160). Plugin count UNCHANGED at 28; all six coverage matrices UNCHANGED; **CE has no code change (paired pin)**.
+
+**Prior: CE 0.2.5 + Enterprise 0.19.0** — paired pin for EE 0.19.0 "No silent false-clean" (per-region evidence-gap + class-O routing + swallow retrofits + air-gapped CVE/KMS criticals + AI-egress redaction). See [CHANGELOG.md](./CHANGELOG.md).
 
 → Full release history: **[CHANGELOG.md](./CHANGELOG.md)**
 → See a sample EE scan output: **[walk-through with synthetic Acme Corp AWS account](https://www.nsauditor.com/ai/docs/sample-scan/)** (no signup required)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nsauditor-ai",
-  "version": "0.2.5",
+  "version": "0.2.6",
   "description": "Modular AI-assisted network security audit platform — Community Edition",
   "type": "module",
   "private": false,