chore: security alerts + supply-chain release hardening#78

Merged

theagenticguy merged 15 commits into

mainfrom

chore/security-and-release-hardening

May 10, 2026

Commits on May 10, 2026

fix(analysis): harden ReDoS-prone diff and route regexes
theagenticguy
committed
fix(embedder): replace `/+$` regex with deterministic trim loop
theagenticguy
committed
fix(frameworks): tighten yarn.lock entry regex to bound backtracking
theagenticguy
committed
ci: pin GitHub Actions to commit SHAs (Pinned-Dependencies)
theagenticguy
committed
ci: tighten top-level workflow permissions (Token-Permissions)
theagenticguy
committed
ci(release): scaffold release.yml with build + SBOM + code-pack + cosign signing
theagenticguy
committed
ci(release): pre-release-gate aggregates scan results before tag creation
theagenticguy
committed
fix(analysis): re-apply ReDoS-prone diff and route regex hardening
theagenticguy
committed
ci(release): release-please.yml refactors to workflow_call release.yml
theagenticguy
committed
docs(repo): RELEASE.md operator runbook
theagenticguy
committed
fix(ingestion): close 5 CodeQL high/medium gaps
theagenticguy
committed
fix(cli): collapse stat+read into one syscall to close TOCTOU windows
theagenticguy
committed
fix(mcp): escape backslashes before quote/pipe in YAML and markdown emitters
theagenticguy
committed
fix(wiki): escape backslash before pipe in escapePipe
theagenticguy
committed
fix(ingestion): use char-by-char escape transcription in relaxedToJson
theagenticguy
committed