stapes-adsa 1.1.0 → 1.1.1

package/AGENTS.md

@@ -55,7 +55,7 @@ only our marker block, leaves Husky / lefthook / etc. intact.
 Default (human):
 
 ```
-stapes-adsa@1.0.0
+stapes-adsa@1.1.0
 
 ✗ fast-path-with-io        1 finding(s)
   src/auth/verify.ts:12:1
@@ -70,8 +70,8 @@ stapes-adsa@1.0.0
 ```json
 {
   "startedAt": "2026-09-01T10:49:45.195Z",
-  "tool": "stapes-adsa@1.0.0",
-  "version": "1.0.0",
+  "tool": "stapes-adsa@1.1.0",
+  "version": "1.1.0",
   "exitCode": 1,
   "checkCount": 5,
   "failed": 1,
@@ -166,7 +166,7 @@ The other three checks (`fast-path-with-io`, `decision-router`, `log-schema`) ar
 }
 ```
 
-## Known limitations (v1.0.0)
+## Known limitations (v1.1.0)
 
 - TypeScript only. No Python, Go, Rust, Java support.
 - No per-check config files. The five checks have fixed heuristics.
@@ -202,7 +202,7 @@ Built by stapes.
 <!-- gitnexus:start -->
 # GitNexus — Code Intelligence
 
-This project is indexed by GitNexus as **adsa** (457 symbols, 489 relationships, 0 execution flows). Use the GitNexus MCP tools to understand code, assess impact, and navigate safely.
+This project is indexed by GitNexus as **adsa** (472 symbols, 503 relationships, 0 execution flows). Use the GitNexus MCP tools to understand code, assess impact, and navigate safely.
 
 > If any GitNexus tool warns the index is stale, run `npx gitnexus analyze` in terminal first.
 

package/CHANGELOG.md

@@ -5,6 +5,19 @@ All notable changes to `stapes-adsa` are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.1.1] - 2026-11-08
+
+### Fixed
+
+- The README and AGENTS.md sample output printed `stapes-adsa@1.0.0`
+  after v1.1.0 shipped. The samples now print the current version.
+
+### Documentation
+
+- `SECURITY.md` now explains the transitive `minimatch` advisory that
+  `npm audit` reports in a consumer's tree, why the linter cannot reach
+  it, and why it cannot be cleared by upgrading `ts-morph`.
+
 ## [1.1.0] - 2026-11-08
 
 ### Changed

package/README.md

@@ -52,7 +52,7 @@ commit. Warnings print and let the commit pass.
 
 ```text
 $ npx stapes-adsa
-stapes-adsa@1.0.0
+stapes-adsa@1.1.0
 
 ✗ fast-path-with-io        1 finding(s)
   src/auth/verify.ts:12:1
@@ -76,8 +76,8 @@ npx stapes-adsa --json | jq '.exitCode, .findings[].message'
 ```json
 {
   "startedAt": "2026-09-01T10:49:45.195Z",
-  "tool": "stapes-adsa@1.0.0",
-  "version": "1.0.0",
+  "tool": "stapes-adsa@1.1.0",
+  "version": "1.1.0",
   "exitCode": 1,
   "checkCount": 5,
   "failed": 1,
@@ -241,7 +241,8 @@ during `--fix-confirm`.
 ## What we measured
 
 On 2026-09-01 we ran `stapes-adsa@1.0.0` against two production TypeScript services
-before announcing it. Both repos had not adopted ADSA yet.
+before announcing it. The numbers below are from that run. Both repos had not
+adopted ADSA yet.
 
 | Repo | .ts files | LoC | Findings | Density |
 |---|---|---|---|---|

package/SECURITY.md

@@ -33,6 +33,32 @@ We fix issues because they're bugs, not because we're buying silence.
 If you're not sure whether something is a security issue, report it.
 We'll triage and let you know.
 
+## Known transitive advisory
+
+`npm audit` in a project that installs `stapes-adsa` reports four
+moderate findings. They are all one issue, not four.
+
+The chain is `stapes-adsa` → `ts-morph` → `@ts-morph/common` → `minimatch`.
+The advisory is [GHSA-g3hv-75wg-m249](https://github.com/advisories/GHSA-g3hv-75wg-m249),
+a denial of service through glob-part amplification, and it affects
+`minimatch` 7.0.0 through 11.0.0.
+
+`@ts-morph/common` declares `minimatch: ^10.0.1`. The 10.x line has no
+fixed release, so the advisory cannot be cleared by upgrading
+`ts-morph`. The fix landed in `minimatch` 11.0.1.
+
+The advisory is not reachable through the linter. `stapes-adsa` walks the
+file tree itself with `readdirSync` and calls `addSourceFileAtPath` with
+one explicit path. It never calls `addSourceFilesAtPaths` and never
+passes a glob pattern. The `minimatch` code in `@ts-morph/common` is
+reachable only through `matchGlobs`, which the linter never enters. A
+traced run of `addSourceFileAtPath` makes zero `minimatch` calls.
+
+This repository pins `minimatch` to 11.0.5 through an `overrides` entry,
+which keeps the repository's own tree clean. An `overrides` entry does
+not apply to a consumer's install, so the advisory remains visible in
+consumer `npm audit` output until `@ts-morph/common` widens its range.
+
 ## Why this tool touches sensitive data
 
 `stapes-adsa` reads TypeScript source files and inspects their AST to

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "stapes-adsa",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "description": "AST-based ADSA (Adaptive Dual-System Architecture) linter for TypeScript. Flags slow paths without logging, fast paths doing I/O, decision points without routing, async boundaries missing the adsa_path log line, and invalid {adsa_path, adsa_area} shapes. Auto-fix safe insertions. Install as pre-commit hook. Stable --json for AI agents. Zero telemetry. MIT.",
   "license": "MIT",
   "author": "stapesco <github@stapes.co.za>",