chore(threatcrush-scan): pin 0.11.5, and pack 2.0.2 to re-sync consumers - #1003
Merged
Conversation
ThreatCrush v0.11.5 is published. The pack pins an exact spec plus an SRI hash and fails closed on a mismatch, so a threatcrush release does not reach pack consumers until the pin moves — this is that bump. threatcrushPackageSpec @profullstack/threatcrush@0.11.3 -> @0.11.5 threatcrushIntegrity sha512-lxWvTt... -> sha512-kIa0rM... The hash was not taken from `npm view` alone. It was reproduced from the published tarball and the two agree: curl -sL $(npm view @profullstack/threatcrush@0.11.5 dist.tarball) -o t.tgz printf 'sha512-'; openssl dgst -sha512 -binary t.tgz | openssl base64 -A -> sha512-kIa0rMs/TdINhryjDDyO2butWxvk6pj4bwnARqhjpOduN6+TcbgAPeZE4cCeZlRqOpq9r0P8cNkjuzd+rN166Q== 0.11.5 carries the `threatcrush restart` command and three installer fixes: the installer now prefers npm over pnpm, removes a stale global install left by another package manager, and warns when PATH still resolves to an older binary instead of reporting success with the old version number. Pack version 2.0.1 -> 2.0.2 so the fleet re-syncs consumers. README updated to match both defaults. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01H3GDps1fD6ccfo93B3ePy1
vu1nz Security Review0 finding(s) in PR #? No security issues found. |
ThreatCrush Security Scan49 finding(s) HIGH/CRITICAL: 1 | MEDIUM: 14 | LOW: 34
Snippets are redacted; ThreatCrush never prints matched credential material. |
ralyodio
added a commit
that referenced
this pull request
Aug 30, 2026
Lockstep bump of every published package. The six packages the cli depends on had drifted to 0.3.0 while the cli sat at 0.3.1; they are all 0.3.2 now, which is what the lockstep script exists to guarantee — pnpm rewrites `workspace:` to a real range at publish time, so anything the cli depends on has to reach the registry at a version that exists. Since v0.3.0: - threatcrush-scan pack pinned to @profullstack/threatcrush@0.11.5 with a reproduced SRI hash, pack 2.0.2 so the fleet re-syncs consumers (#1003) - unique rollout instance IDs (#1002) - cloud vault passphrase prompt no longer hangs on non-TTY stdin (#1001) - DNS config persisted in JSON mode (#1000) - netcup adapter shipped in the command tree (#969) Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01H3GDps1fD6ccfo93B3ePy1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Bumps the
threatcrush-scanpack to ThreatCrush 0.11.5, and the pack itself to 2.0.2 so the fleet re-syncs consumers.Why
The pack pins an exact spec plus an SRI hash and refuses to install on a mismatch. That is deliberate — but it means a ThreatCrush release does not reach pack consumers until someone moves the pin. v0.11.5 published today, so consumers were still installing 0.11.3.
0.11.5 carries the
threatcrush restartcommand plus three installer fixes: the installer now prefers npm over pnpm, removes a stale global install left behind by another package manager, and warns when PATH still resolves to an older binary instead of printing "installed successfully" next to the old version number.The hash
Not taken from
npm viewalone — reproduced from the published tarball, and the two agree:That is exactly the check the workflow performs before installing, so this pin is verified against the bytes the registry actually serves.
Testing
packages/actions/src/index.test.ts— 21/21 pass (this is the suite that reads the pack'sthreatcrushPackageSpec/threatcrushIntegritydefaults).packages/actions-fleet-core— 69/69 pass across 6 files, includingaction-pack/schema,renderandcatalog.🤖 Generated with Claude Code
https://claude.ai/code/session_01H3GDps1fD6ccfo93B3ePy1