Skip to content

v1.4.0 - Security Hardening, Node 22, Expanded Test Suite

Latest
Latest

Choose a tag to compare

View all tags
@superbasicstudio superbasicstudio released this 31 Mar 23:56
v1.4.0
6537b95

What's Changed

Security

  • Pinned all dependency versions to exact (removed caret/tilde ranges) to prevent supply chain drift
  • Fixed 3 dev dependency vulnerabilities (brace-expansion, minimatch, picomatch)
  • Pinned GitHub Actions to commit SHAs to prevent tag-hijack attacks
  • Added npm audit job to CI pipeline
  • Added least-privilege permissions to all workflows

Added

  • Expanded test suite from 10 to 48 tests (CLI, templates, security, package integrity)
  • .npmrc with security defaults (save-exact, audit-on-install)
  • .github/dependabot.yml for automated dependency and GitHub Actions update PRs

Changed

  • Minimum Node.js version raised to 22 (dropped EOL Node 16, 18, 20)
  • CI now tests on Node 22 and 24
  • Updated SECURITY.md, README.md, CHANGELOG.md

Full Changelog: v1.3.1...v1.4.0

Assets 2
Loading