securenow 8.25.0 → 8.25.1

package/SKILL-API.md

@@ -2,7 +2,7 @@
 
 > **Node.js security:** Use a supported, patched runtime: Node.js 22.23.4+, 24.22.1+, or 26.12.1+ on its respective release line. Earlier patches are affected by [CVE-2026-111497](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases). Upgrading the SecureNow package does not patch Node.js; upgrade the runtime and restart every application process.
 
-The integration playbook for the `securenow` npm package. A coding agent that reads only this file can plug SecureNow into a Node.js app, turn on every feature, deploy it and prove it works. It describes 8.25.0; items marked **(8.25.0+)** are new in 8.25.0, so an older install needs `npm install securenow@latest` for them (check with `npx securenow version`). The terminal reference is [SKILL-CLI.md](./SKILL-CLI.md). Both files ship in `node_modules/securenow/`.
+The integration playbook for the `securenow` npm package. A coding agent that reads only this file can plug SecureNow into a Node.js app, turn on every feature, deploy it and prove it works. It describes 8.25.1; items marked **(8.25.0+)** are new in 8.25.0, so an older install needs `npm install securenow@latest` for them (check with `npx securenow version`). The terminal reference is [SKILL-CLI.md](./SKILL-CLI.md). Both files ship in `node_modules/securenow/`.
 
 ## Rules for the agent
 
@@ -419,7 +419,7 @@ So a `runtime.json` left on a server beats the `credentials.production.json` nex
 
 ### 5.8 Blocklist, allowlist, trusted IPs
 
-- **Blocklist:** block an IPv4 address or CIDR everywhere or on a route, optionally with an expiry (the dashboard, CLI and API don't accept IPv6 entries yet). An unblock stops enforcement and keeps the history.
+- **Blocklist:** block an IP address or CIDR range, IPv4 or IPv6, everywhere or on a route, optionally with an expiry (IPv6 ranges are enforced by securenow 8.25.0+). An unblock stops enforcement and keeps the history.
 
   ```bash
   npx securenow blocklist add 203.0.113.42 --env production --duration 24h --reason "credential stuffing"
@@ -807,7 +807,7 @@ Bad signs: no `[securenow]` line at all (the preload is not on the command that
 **Not supported:** Edge runtimes (Cloudflare Workers, Vercel Edge, Next.js Edge middleware and routes), Deno, `Bun.serve`, browser telemetry.
 **Not tested:** Vercel (firewall unverified on its serverless functions), AWS Lambda and other serverless platforms.
 **Layers 2 to 4:** turn them on with 8.25.0+ only (in 8.24.0 layer 2 dropped nothing for most apps and layers 3 and 4 mishandled IPv6). **Cloud WAF (layer 4):** request format tested, not run against real Cloudflare, AWS or GCP accounts; on Cloudflare your own WAF rule must reference the `securenow-blocklist` list.
-**IPv6:** layer 1 and trusted proxies match IPv6 addresses and IPv6 CIDR ranges **(8.25.0+; before, IPv6 ranges never matched)**. The dashboard, CLI and API accept only IPv4 addresses and CIDRs in the blocklist, allowlist, trusted IPs, rate limits and challenges.
+**IPv6:** the blocklist, allowlist, trusted IPs, rate limits, challenges and API-key IP limits take IPv6 addresses and CIDR ranges, stored in canonical form (`2001:DB8::1` = `2001:db8::1`); layer 1 and trusted proxies match them **(8.25.0+; older SDKs match exact IPv6 addresses but ignore IPv6 ranges)**. A trusted-IP range can be no wider than /8 (IPv4) or /32 (IPv6).
 **`nuxt dev`:** before 8.25.0 the client IP was unknown, so IP blocking only applied to the built server.
 **Log redaction (8.25.0+)** goes by field names and value shapes: a secret in free text with no recognizable shape is exported as written.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "securenow",
-  "version": "8.25.0",
+  "version": "8.25.1",
   "mcpName": "ai.securenow/securenow",
   "description": "OpenTelemetry instrumentation for Node.js, Next.js, and Nuxt - Send traces and logs to any OTLP-compatible backend",
   "type": "commonjs",