nsauditor-ai 0.2.5 → 0.2.7

package/README.md

@@ -17,7 +17,9 @@ NSAuditor AI is the open-source core of a privacy-first security intelligence pl
 
 ## What's New
 
-**Latest: CE 0.2.5 + Enterprise 0.19.0** (June 2026) — paired pin for **EE 0.19.0** "No silent false-clean": the largest false-clean-class closure since the framework cycles — an un-scanned cloud region, a denied API call, or a logging-but-not-delivering trail can no longer read CLEAN at either the compliance verdict or the MCP transport. The shared `forEachRegion` now emits a per-region evidence-gap for every errored/access-denied AWS region (with class-O routing that fail-closes exactly that source's native attested controls across all six frameworks), plus four swallow→gap retrofits (1150 SQS/SNS, 1022 Azure storage, 1200 GuardDuty, 1040 CloudTrail delivery-failure). It also fixes two air-gapped/IAM criticals from the Mythos architecture review (the offline CVE matcher now fails-closed on distro/epoch/build-suffixed package versions; plugin 1110 keeps HIGH on the AWS-default root-delegation KMS key policy) and stops the AI-enrichment prompt from leaking the scan target (public IP/hostname/MAC/secrets) to the external LLM. Plugin count UNCHANGED at 28; all six coverage matrices UNCHANGED; CE has no code change (paired pin).
+**Latest: CE 0.2.7 + Enterprise 0.19.2** (June 2026) — paired pin for **EE 0.19.2** "Confirmed false-negative tail": six more gauntlet-confirmed Tier-B false-negatives across the Pro/Enterprise cloud auditors, each TDD'd and independently adversarially reviewed — Azure Key Vault legacy access-policy per-verb breadth (a 2-verb decrypt+unwrapKey envelope-decryption grant now flags) + two surfaced titlePattern anchor-drifts + drift-detector closure (1222); broad-but-not-full **public** GCP firewall source ranges → HIGH, RFC1918 discounted (1021); AWS KMS PendingDeletion keys now policy-audited — the deletion is reversible (1070); a CodePipeline sticky approval-latch — each production stage now needs its own gate (1100); GCP Storage bucket-enumeration truncation evidence-gap, class-O-routed (1024); and a CloudTrail data-events read-coverage caveat — WriteOnly drops S3 GetObject exfiltration events (1040). Plugin count UNCHANGED at 28; all six coverage matrices UNCHANGED; **CE has no code change (paired pin)**.
+
+**Prior: CE 0.2.6 + Enterprise 0.19.1** — paired pin for EE 0.19.1 "Confirmed false-negative batch" (7 cloud plugins hardened: 1030/1150/1130/1120/1080/1025/1160). See [CHANGELOG.md](./CHANGELOG.md).
 
 → Full release history: **[CHANGELOG.md](./CHANGELOG.md)**
 → See a sample EE scan output: **[walk-through with synthetic Acme Corp AWS account](https://www.nsauditor.com/ai/docs/sample-scan/)** (no signup required)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nsauditor-ai",
-  "version": "0.2.5",
+  "version": "0.2.7",
   "description": "Modular AI-assisted network security audit platform — Community Edition",
   "type": "module",
   "private": false,