supply-chain-guard 5.2.43 → 5.2.44

package/README.md

@@ -343,6 +343,21 @@ See [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines. The most impactful contri
 
 ## Changelog
 
+### v5.2.44 (2026-07-01)
+**Dependency maintenance: latest toolchain + commander 14**
+
+Routine dependency refresh. All dependencies are now at their latest versions with zero known
+vulnerabilities. No detection-logic or output-format changes: this is a maintenance-only release.
+
+- Runtime: commander 13 -> 14 (stays on the CommonJS line; commander 15 is ESM-only and requires
+  Node >=22.12, incompatible with this CommonJS package on Node >=20).
+- Dev/build: typescript 5 -> 6 (added an explicit `"types": ["node"]` to tsconfig.json, since
+  TypeScript 6 no longer auto-includes @types/node), vitest 3 -> 4, @types/node 22 -> 26, and the
+  test runner's transitive vite 7 -> 8 plus an esbuild refresh. Removed two now-obsolete
+  esbuild/vite overrides.
+- CI: pinned GitHub Actions bumped to current releases (checkout v7, setup-node v6, github-script
+  v9, setup-python v6); SHA pins verified against the upstream tags.
+
 ### v5.2.43 (2026-06-30)
 **Threat intel: Contagious Interview "Fake Font" npm + Go wave (June 29, 2026)**
 

package/action.yml

@@ -46,7 +46,7 @@ runs:
   using: "composite"
   steps:
     - name: Setup Node.js
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@v6
       with:
         node-version: "22"
 
@@ -130,7 +130,7 @@ runs:
 
     - name: Comment on PR
       if: inputs.comment-on-pr == 'true' && github.event_name == 'pull_request' && steps.scan.outputs.findings-count != '0'
-      uses: actions/github-script@v7
+      uses: actions/github-script@v9
       continue-on-error: true
       with:
         script: |

package/dist/cli.js

@@ -20,7 +20,7 @@ const program = new commander_1.Command();
 program
     .name("supply-chain-guard")
     .description("Open-source supply-chain security scanner. Detects GlassWorm and similar malware campaigns in npm packages, PyPI packages, code repos, VS Code extensions, and project dependencies.")
-    .version("5.2.43");
+    .version("5.2.44");
 // ── scan command ────────────────────────────────────────────────────
 program
     .command("scan")

package/dist/reporter.js

@@ -55,7 +55,7 @@ function formatJson(report) {
 function formatText(report) {
     const lines = [];
     // ── layout constants ───────────────────────────────────────────────────────
-    const VERSION = "5.2.43";
+    const VERSION = "5.2.44";
     const W = 76; // visible chars between "│ " and " │" (total line = 80)
     // ── ANSI helpers ───────────────────────────────────────────────────────────
     const stripAnsi = (s) => s.replace(/\x1b\[[0-9;]*m/g, "");
@@ -490,7 +490,7 @@ function formatSarif(report) {
                 tool: {
                     driver: {
                         name: "supply-chain-guard",
-                        version: "5.2.43",
+                        version: "5.2.44",
                         informationUri: "https://github.com/homeofe/supply-chain-guard",
                         rules,
                     },
@@ -552,7 +552,7 @@ function formatSbom(report) {
             timestamp: report.timestamp,
             tools: {
                 components: [
-                    { type: "application", name: "supply-chain-guard", version: "5.2.43" },
+                    { type: "application", name: "supply-chain-guard", version: "5.2.44" },
                 ],
             },
             component: {
@@ -704,7 +704,7 @@ footer{text-align:center;padding:24px;color:#94a3b8;font-size:13px}
   ` : ""}
 
   <footer>
-    Generated by <a href="https://github.com/homeofe/supply-chain-guard">supply-chain-guard</a> v5.2.43
+    Generated by <a href="https://github.com/homeofe/supply-chain-guard">supply-chain-guard</a> v5.2.44
   </footer>
 </div>
 <script>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "supply-chain-guard",
-  "version": "5.2.43",
+  "version": "5.2.44",
   "description": "Open-source supply-chain security scanner for npm, PyPI, Cargo, Go, Docker, VS Code extensions, GitHub Actions, IaC and Solana C2. Detects GlassWorm, Shai-Hulud, PPE attacks, dependency confusion and 120+ malware indicators. Generates CycloneDX 1.6 SBOMs and verifies SLSA provenance.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -56,15 +56,11 @@
     "socket.yml"
   ],
   "dependencies": {
-    "commander": "^13.1.0"
+    "commander": "^14.0.3"
   },
   "devDependencies": {
-    "@types/node": "^22.13.0",
-    "typescript": "^5.7.0",
-    "vitest": "^3.2.6"
-  },
-  "overrides": {
-    "esbuild": "^0.28.1",
-    "vite": "^7.3.5"
+    "@types/node": "^26.0.1",
+    "typescript": "^6.0.3",
+    "vitest": "^4.1.9"
   }
 }