paqad-ai 1.75.2 → 1.75.3

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # paqad-ai
 
+## 1.75.3
+
+### Patch Changes
+
+- dc6976f: Reframe the security workflow copy to remove two overclaims (#206). User-facing text no longer calls the security pass a "full OWASP pentest" with "full OWASP coverage" or claims it proves code is "safe"; it is now described as an OWASP WSTG-structured security self-review that hardens code before a certified pentest, it does not replace one. Copy-only: workflow ids, routing patterns, the `pentest` invocation alias, and all code are unchanged.
+
 ## 1.75.2
 
 ### Patch Changes

package/README.md

@@ -57,7 +57,7 @@ No account, no API key, no subscription. Prefer not to install anything? Run `np
 | **One setup, every tool**    | Configure Claude, Cursor, Copilot, Gemini, and the rest from one source of truth       |
 | **Workflows, not prompts**   | Your team's process runs the same way every time, instead of being re-typed            |
 | **Proof, not promises**      | Automatic checks confirm tests, specs, docs, and security before "done" counts         |
-| **Security as a workflow**   | A full OWASP pentest pass, with retests, built in                                      |
+| **Security as a workflow**   | An OWASP WSTG-structured security self-review, with retests, built in                  |
 | **Design as a workflow**     | Your UI audited against your own design system                                         |
 | **Docs that stay current**   | The framework keeps your documentation in sync with the code                           |
 | **Fewer tokens, on purpose** | Loads a lean resident slice, not the whole repo. Measured 49-61% smaller resident load |
@@ -228,7 +228,7 @@ paqad-ai can turn the plain rules in your `docs/instructions/rules/` into small
 
 Most tools treat security as a separate scanner you remember to run. paqad-ai treats it as part of the work.
 
-**Security workflow.** A resumable pentest pass with full OWASP coverage, timed to the moment the industry is formalizing security for AI agents.
+**Security workflow.** A resumable, OWASP WSTG-structured security self-review that hardens code before a certified pentest, timed to the moment the industry is formalizing security for AI agents.
 
 | Standard                    | Coverage         |
 | --------------------------- | ---------------- |
@@ -259,7 +259,7 @@ It writes a local `curl` playbook to prove each finding (it never runs attacks f
 
 </details>
 
-**Design workflow.** The same rigor, pointed at the front end. The design-test pass audits your UI against your own design system, covering tokens, components, accessibility, responsive behavior, and motion, and design-retest replays the findings after you fix them. Pentest checks that the code is safe. Design-test checks that the interface is consistent.
+**Design workflow.** The same rigor, pointed at the front end. The design-test pass audits your UI against your own design system, covering tokens, components, accessibility, responsive behavior, and motion, and design-retest replays the findings after you fix them. The security self-review hardens the code. Design-test checks that the interface is consistent.
 
 ## Documentation that stays current
 

package/dist/cli/index.js

@@ -35093,7 +35093,7 @@ init_cancelled_error();
 init_events();
 
 // src/index.ts
-var VERSION = "1.75.2";
+var VERSION = "1.75.3";
 
 // src/cli/commands/audit.ts
 init_esm_shims();

package/dist/index.js

@@ -24430,7 +24430,7 @@ var memoizedReport;
 function getEngineVersionReport() {
   if (memoizedReport === void 0) {
     memoizedReport = Object.freeze({
-      engineVersion: normalizeEngineVersion("1.75.2"),
+      engineVersion: normalizeEngineVersion("1.75.3"),
       minConsumerVersion: MIN_CONSUMER_VERSION,
       deprecatedAsOf: DEPRECATED_AS_OF
     });
@@ -44197,7 +44197,7 @@ function formatVerdictSummary(input2) {
 
 // src/verification/repository/run-repository-verification.ts
 function verifierVersion() {
-  return true ? "1.75.2" : "0.0.0-dev";
+  return true ? "1.75.3" : "0.0.0-dev";
 }
 function backstopGates() {
   return [
@@ -47112,7 +47112,7 @@ var WorkflowEngine = class {
 };
 
 // src/index.ts
-var VERSION = "1.75.2";
+var VERSION = "1.75.3";
 function getFrameworkName() {
   return "paqad-ai";
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "paqad-ai",
-  "version": "1.75.2",
+  "version": "1.75.3",
   "description": "Spec-driven development framework — AI agents that think before they type",
   "type": "module",
   "license": "MIT",
@@ -78,7 +78,7 @@
     "execa": "^9.6.0",
     "fast-glob": "^3.3.3",
     "handlebars": "^4.7.9",
-    "openai": "^7.0.0",
+    "openai": "^7.2.0",
     "ora": "^9.4.1",
     "pathe": "^2.0.3",
     "voyageai": "^0.4.0",