agentbreeder 2.7.2__tar.gz → 2.7.3__tar.gz

{agentbreeder-2.7.2 → agentbreeder-2.7.3}/CHANGELOG.md

@@ -91,6 +91,18 @@ This project follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/) an
   canonical `<x>Gi`) valid values.
 
 ### Security
+- **Cleared `dashboard` high-severity advisories via npm `overrides` + a `vite` patch bump** —
+  pinned `hono` to `^4.12.25` (transitive through the `shadcn` CLI → MCP SDK; fixes the IPv6
+  deny-rule bypass, Set-Cookie injection, JWT-scheme, and mount-prefix advisories) and `esbuild`
+  to `^0.28.1` (transitive through `vite`; fixes the Deno-module integrity and dev-server
+  file-read advisories). A second wave of advisories surfaced afterward and is cleared here too:
+  bumped `vite` to `^7.3.5` (fixes the high-severity `launch-editor` NTLMv2 UNC disclosure and the
+  `server.fs.deny` Windows-alternate-path bypass — patched in 7.3.4, **no `vite` 8 major bump**),
+  and added overrides for `@babel/core` `^7.29.7` (transitive through `@vitejs/plugin-react` /
+  `shadcn` / `eslint-plugin-react-hooks`; fixes the sourceMappingURL arbitrary-file-read advisory)
+  and `js-yaml` `^4.2.0` (transitive through `eslint` / `cosmiconfig`; fixes the merge-key
+  quadratic-complexity DoS). All are build/dev-time dependencies not bundled into the shipped app.
+  `npm audit` now reports 0 vulnerabilities, and the dashboard build + 227 tests pass.
 - **Bumped `vitest` to `^4.1.8` in `sdk/typescript`** (was `^1.6.0`), clearing a critical advisory
   (GHSA — Vitest UI server arbitrary file read/execute, fixed in 4.1.0). Dev/test-only dependency;
   all 94 SDK tests pass on the new major. (`dashboard` was already on a patched 4.1.x.)

{agentbreeder-2.7.2 → agentbreeder-2.7.3}/CLAUDE.md

@@ -735,6 +735,17 @@ AgentBreeder ships across **three repositories** that must stay in sync at all t
 - **New connector or feature**: check if `agentbreeder-cloud` needs to expose it
 - **Version bump**: update `website/components/footer.tsx` version badge, update features/docs pages
 - **Breaking change**: `agentbreeder-cloud` must get a companion PR before or alongside
+- **Update the guides in BOTH repos**: any feature that changes cross-repo behaviour MUST update `CLAUDE.md` in **both** `agentbreeder` and `agentbreeder-cloud`, spelling out *what changes on each side* (see "Documenting a cross-repo feature" below). `AGENTS.md` is generated by 100xprism (`# Source of truth: modules/<slug>/SKILL.md`) — **do not hand-edit it**; put the rule in `CLAUDE.md` and regenerate `AGENTS.md` (`/update-claude`) so both AI harnesses stay in sync.
+
+### Documenting a cross-repo feature (bidirectional)
+
+When you add or change a feature, record what must change on **each** side, in both directions:
+
+| Direction | Trigger | What to update |
+|---|---|---|
+| **OSS → Cloud** | New engine/CLI/connector/schema capability lands here | Note in Cloud `CLAUDE.md` how Cloud should expose/gate it; file a Cloud issue; update Cloud ROADMAP sequencing |
+| **Cloud → OSS** | Cloud needs a capability that belongs in the core (per OSS-first policy) | File an OSS issue here first; implement in OSS; Cloud consumes it as a dependency — never fork logic into Cloud |
+| **Either → Website** | User-facing behaviour, naming, or pricing changes | Update `website/` content + keep terminology identical across OSS, Cloud, and site |
 
 > The cloud project uses `agentbreeder` packages as its deploy infrastructure.
 > A silent break in OSS will silently break Cloud. The website going stale misrepresents the product.
@@ -751,6 +762,7 @@ AgentBreeder ships across **three repositories** that must stay in sync at all t
 6. **Update the docs** — if you changed a public API or CLI command
 7. **Add an example** — if you added a new framework or deployer, add it to `examples/`
 8. **Scaffold with `/agent-build`** — when starting a new agent project, run `/agent-build` in Claude Code. The Advisory Path generates IDE config files (`CLAUDE.md`, `AGENTS.md`, `.cursorrules`, `.antigravity.md`) tailored to the chosen framework, model, and deployment target. These files give Claude and Cursor context-aware guidance for the specific agent being built.
+9. **Sync the guides both ways** — if the feature touches Cloud or the website, update `CLAUDE.md` in **both** repos per the Cross-Repo Sync table above (what changes OSS→Cloud, Cloud→OSS, and →Website), then regenerate `AGENTS.md` (`/update-claude`) rather than hand-editing it.
 
 ---
 

{agentbreeder-2.7.2 → agentbreeder-2.7.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentbreeder
-Version: 2.7.2
+Version: 2.7.3
 Summary: Define Once. Deploy Anywhere. Govern Automatically.
 Project-URL: Homepage, https://www.agentbreeder.io
 Project-URL: Repository, https://github.com/agentbreeder/agentbreeder

{agentbreeder-2.7.2 → agentbreeder-2.7.3}/dashboard/package.json

@@ -33,7 +33,11 @@
   },
   "overrides": {
     "react": "19.2.5",
-    "react-dom": "19.2.7"
+    "react-dom": "19.2.7",
+    "hono": "^4.12.25",
+    "esbuild": "^0.28.1",
+    "@babel/core": "^7.29.7",
+    "js-yaml": "^4.2.0"
   },
   "devDependencies": {
     "@eslint/js": "^9.39.1",