pmd-ruleset-visualizer 1.0.0 → 1.0.1

package/README.md

@@ -68,7 +68,7 @@ pmd check -d /usr/src -R rulesets/java/quickstart.xml -f text
 Requires **Node.js 18+**.
 
 ```bash
-npm install -f pmd-ruleset-visualizer
+npm install -g pmd-ruleset-visualizer
 ```
 
 The bundled `public/sample-ruleset.xml` is loaded automatically on first open so the app is never blank. It is included in the published npm package via the `files` field in `package.json`.
@@ -201,6 +201,19 @@ Click the ☽/☀ button (top-right) to toggle dark mode. The preference is save
 
 
 
+## Security
+
+The Express server binds to `127.0.0.1` — it is not accessible from the network.
+
+`/api/read-file` enforces an extension allowlist. Only these file types may be read:
+
+| Purpose | Extensions |
+|---------|-----------|
+| Ruleset auto-load | `.xml` `.ruleset` |
+| Monaco source viewer | `.cls` `.trigger` `.apex` `.java` `.js` `.ts` `.jsx` `.tsx` `.py` `.go` `.cs` `.cpp` `.cc` `.cxx` `.c` `.h` `.swift` `.kt` `.rb` `.php` `.scala` `.groovy` `.pl` `.html` `.jsp` `.vue` |
+
+Any other extension (`.env`, `.pem`, `.key`, config files, binaries) is rejected with HTTP 400.
+
 ## Important Notes
 
 - All XML parsing is local. No ruleset content is sent to any external service.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pmd-ruleset-visualizer",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "private": false,
   "description": "Local graphical explorer and runner for PMD XML rulesets with Monaco editor integration",
   "main": "server.js",
@@ -35,6 +35,10 @@
     "dev": "node --watch server.js",
     "build": "obfuscli build -p . -o ./dist --preset medium --exclude 'node_modules,dist,.git,*.xml,*.md,*.json,*.css,*.ico,*.html' && rm -f dist/CLAUDE.md dist/SKILLS.md"
   },
+  "overrides": {
+    "uuid": "^11.0.0",
+    "minimatch": "^11.0.1"
+  },
   "dependencies": {
     "exceljs": "^4.4.0",
     "express": "^5.1.0",