Release 1.2.1 — seven advisories leave the tree

.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "commitlore",
   "displayName": "CommitLore",
-  "version": "1.2.0",
+  "version": "1.2.1",
   "description": "Recorded decisions from git history, delivered to the agent before it edits. Constraints, alternatives already ruled out, and warnings left by whoever was here last.",
   "author": {
     "name": "MongLong0214",

.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "commitlore",
-  "version": "1.2.0",
+  "version": "1.2.1",
   "description": "Decision memory from Git history, with verified capture for coding sessions.",
   "author": {
     "name": "MongLong0214",

.github/workflows/canonical-merge.yml

@@ -158,7 +158,7 @@ jobs:
           # ever narrows what job two will accept.
           echo "${{ steps.fetch.outputs.head }}" > /tmp/canonical.head
 
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: canonical-tree
           path: |
@@ -193,7 +193,7 @@ jobs:
         with:
           node-version: '22.23.2'
 
-      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: canonical-tree
           path: /tmp/canonical

.github/workflows/ci.yml

@@ -101,7 +101,7 @@ jobs:
       - name: PRD-F2 100k-commit query performance
         env:
           COMMITLORE_PERF_LARGE: "1"
-        run: npx vitest run test/index-perf.test.ts --reporter=basic
+        run: npx vitest run test/index-perf.test.ts --reporter=default
 
       # #392: bench/verify.mjs existed for weeks with no npm script and no step
       # here, so the result schema drifted five fields behind the runner and a

CHANGELOG.md

@@ -4,6 +4,64 @@ Release notes for 1.0.0, 1.0.1 and 1.0.2 are on the
 [GitHub releases page](https://github.com/MongLong0214/commitlore/releases); they
 were not written here.
 
+## 1.2.1
+
+A security release, and one line that had been asserting something nobody checked.
+
+**Seven advisories left the tree, and two of them shipped.** `npm audit --omit=dev`
+was failing on `main`, not only on the dependency pull requests that were being
+blamed for it: `fast-uri` (high, four GHSAs, reached through `ajv`) and `qs`
+(moderate, two, reached through the MCP SDK's `express`) were both in the runtime
+tree — the tree that gets bundled into `dist/commitlore.mjs` and installed. They
+are fixed at `fast-uri` 3.1.7 and `qs` 6.16.0. Five more, including one rated
+critical, were `esbuild <=0.24.2` reachable only through vitest 2's own
+dependencies; the vitest 4 upgrade below is what removes them. `npm audit` is now
+silent on both surfaces.
+
+**The push hook no longer reports records that do not exist as unsent.** On a
+failed notes mirror the line said "the records for these commits are still only
+local" whether or not any record existed — #632 asked "is there a local note
+waiting?" and the answer was hard-coded to yes. A repository with no notes ref at
+all was told to run `commitlore sync`, and found nothing to send. The hook now
+checks, locally, before it claims; when there is nothing waiting it says so. The
+check is ref-scoped rather than commit-scoped on purpose: the mirror publishes
+`refs/notes/commitlore` whole, so a record written against an already-pushed
+commit is still unsent, and a commit-scoped check would call that "nothing
+waiting" — wrong in the dangerous direction.
+
+**`commitlore sync` keeps one row per remote.** An unreachable remote answers with
+two lines of git diagnostic, and both went into a column that promises one. The
+row broke in half and the trailing `fatal:` read as a bare error standing above
+the table rather than as that remote's result.
+
+**Upgrades.** vitest 2.1.9 → 4.1.11, `@modelcontextprotocol/sdk` 1.29.0 → 1.30.0,
+js-yaml 5.2.3 → 5.4.1, `upload-artifact` v4.6.2 → v7.0.1 and `download-artifact`
+v4.3.0 → v8.0.1. vitest 4 needed three things with it: `--reporter=basic` no
+longer exists, changing `ci.yml` moves the reviewed-workflow lock deliberately,
+and the 5s default test timeout no longer fits a runner whose per-file startup
+costs more — every failure measured during that upgrade was a timeout, none was
+an assertion.
+
+**Reviewed, with one exception recorded.** 1.2.0 shipped without a cross-provider
+review and said so here. This one had them: `gpt-5.6-sol`, read-only and asked to
+*disprove* rather than approve, went through the dependency batch (it recomputed
+the source digest and all 310 `dist` entries from the commit's git blobs
+independently) and the artifact-action upgrade (it read the pinned action sources
+and mapped every uploaded path to where the next job reads it). The exception is
+the security fix itself, which was merged first and without one, because leaving
+two advisories in the runtime tree to wait for a reviewer is the worse trade. Both
+reviews recorded their own limits — neither could rerun the Docker build, and
+neither dispatched the canonical-merge workflow — and those limits stand.
+
+**Not changed, deliberately.** The guard's short-alternative false positive
+(#858) was measured rather than fixed. At one distinctive token the corroboration
+strength is structurally 1.00 whatever the token is, because the corpus weight
+that separates a rare `redis` from an ordinary `read` is divided out by its own
+denominator. Every rule that removes the false positive also removes
+`add a Redis client` → `shared Redis cache`, a documented true positive. Trading
+that for an advisory false positive is the wrong direction for a tool that
+declares itself advisory; the issue carries the measurements.
+
 ## 1.2.0
 
 > **Recorded as held for want of a reviewer, not as reviewed.** Every change in

README.ja.md

@@ -47,18 +47,18 @@
 </p>
 
 ```bash
-curl -fsSL https://raw.githubusercontent.com/MongLong0214/commitlore/v1.2.0/install.sh | sh -s v1.2.0
+curl -fsSL https://raw.githubusercontent.com/MongLong0214/commitlore/v1.2.1/install.sh | sh -s v1.2.1
 ```
 
 <details>
 <summary>先にインストーラーを読みたいですか？</summary>
 
 ```bash
-curl -fsSLO https://raw.githubusercontent.com/MongLong0214/commitlore/v1.2.0/install.sh
-sh install.sh v1.2.0
+curl -fsSLO https://raw.githubusercontent.com/MongLong0214/commitlore/v1.2.1/install.sh
+sh install.sh v1.2.1
 
 # あるいはスクリプトを使わずに。スクリプトが作るチェックアウトは自分でも作れます。
-git clone --depth 1 --branch v1.2.0 https://github.com/MongLong0214/commitlore
+git clone --depth 1 --branch v1.2.1 https://github.com/MongLong0214/commitlore
 node commitlore/dist/commitlore.mjs --version
 ```
 
@@ -107,13 +107,13 @@ CommitLore はその判断をコードのそばに残します。
 macOS と Linux:
 
 ```bash
-curl -fsSL https://raw.githubusercontent.com/MongLong0214/commitlore/v1.2.0/install.sh | sh -s v1.2.0
+curl -fsSL https://raw.githubusercontent.com/MongLong0214/commitlore/v1.2.1/install.sh | sh -s v1.2.1
 ```
 
 Windows:
 
 ```powershell
-& ([scriptblock]::Create((irm https://raw.githubusercontent.com/MongLong0214/commitlore/v1.2.0/install.ps1))) v1.2.0
+& ([scriptblock]::Create((irm https://raw.githubusercontent.com/MongLong0214/commitlore/v1.2.1/install.ps1))) v1.2.1
 ```
 
 Node.js 22.23.2+ と Git が必要です。スクリプトは何かを書き込む前に両方を確認します。
@@ -232,7 +232,7 @@ superseded な決定は大いに関係があり得ても、現在の指針とし
 
 ## 現場報告であって測定ではない
 
-無関係な一つのリポジトリで、初めて v1.2.0 を入れた人の一回の実行です。ここでは何も測定されず、
+無関係な一つのリポジトリで、初めて v1.2.1 を入れた人の一回の実行です。ここでは何も測定されず、
 evidence log にもありません。上の段落が表で扱っていない loop を主張しているため、このページにあります。
 
 その人は agent に丸めの不具合を直すよう頼み、decimal library はすでに検討して却下したと付け加え、

README.ko.md

@@ -47,18 +47,18 @@
 </p>
 
 ```bash
-curl -fsSL https://raw.githubusercontent.com/MongLong0214/commitlore/v1.2.0/install.sh | sh -s v1.2.0
+curl -fsSL https://raw.githubusercontent.com/MongLong0214/commitlore/v1.2.1/install.sh | sh -s v1.2.1
 ```
 
 <details>
 <summary>먼저 설치기를 읽어 보고 싶나요?</summary>
 
 ```bash
-curl -fsSLO https://raw.githubusercontent.com/MongLong0214/commitlore/v1.2.0/install.sh
-sh install.sh v1.2.0
+curl -fsSLO https://raw.githubusercontent.com/MongLong0214/commitlore/v1.2.1/install.sh
+sh install.sh v1.2.1
 
 # 또는 스크립트를 건너뜁니다. 스크립트가 만드는 체크아웃은 직접 만들 수 있습니다.
-git clone --depth 1 --branch v1.2.0 https://github.com/MongLong0214/commitlore
+git clone --depth 1 --branch v1.2.1 https://github.com/MongLong0214/commitlore
 node commitlore/dist/commitlore.mjs --version
 ```
 
@@ -107,13 +107,13 @@ CommitLore는 그 판단을 코드 곁에 보관합니다.
 macOS와 Linux:
 
 ```bash
-curl -fsSL https://raw.githubusercontent.com/MongLong0214/commitlore/v1.2.0/install.sh | sh -s v1.2.0
+curl -fsSL https://raw.githubusercontent.com/MongLong0214/commitlore/v1.2.1/install.sh | sh -s v1.2.1
 ```
 
 Windows:
 
 ```powershell
-& ([scriptblock]::Create((irm https://raw.githubusercontent.com/MongLong0214/commitlore/v1.2.0/install.ps1))) v1.2.0
+& ([scriptblock]::Create((irm https://raw.githubusercontent.com/MongLong0214/commitlore/v1.2.1/install.ps1))) v1.2.1
 ```
 
 Node.js 22.23.2+와 Git이 필요합니다. 스크립트는 무엇이든 쓰기 전에 둘을 확인합니다.
@@ -232,7 +232,7 @@ CommitLore는 이렇게 묻습니다.
 
 ## 현장 보고이지 측정은 아닙니다
 
-관련 없는 한 저장소에서 v1.2.0을 처음 설치한 사람이 한 번 실행한 사례입니다. 여기서는 아무것도
+관련 없는 한 저장소에서 v1.2.1을 처음 설치한 사람이 한 번 실행한 사례입니다. 여기서는 아무것도
 측정하지 않았고 evidence log에도 없습니다. 위 문단이 표로 다루지 않는 loop를 주장하기 때문에
 이 페이지에 있습니다.
 

README.md

@@ -48,18 +48,18 @@
 </p>
 
 ```bash
-curl -fsSL https://raw.githubusercontent.com/MongLong0214/commitlore/v1.2.0/install.sh | sh -s v1.2.0
+curl -fsSL https://raw.githubusercontent.com/MongLong0214/commitlore/v1.2.1/install.sh | sh -s v1.2.1
 ```
 
 <details>
 <summary>Prefer to read the installer first?</summary>
 
 ```bash
-curl -fsSLO https://raw.githubusercontent.com/MongLong0214/commitlore/v1.2.0/install.sh
-sh install.sh v1.2.0
+curl -fsSLO https://raw.githubusercontent.com/MongLong0214/commitlore/v1.2.1/install.sh
+sh install.sh v1.2.1
 
 # Or skip the script: the checkout it makes is one you can make yourself.
-git clone --depth 1 --branch v1.2.0 https://github.com/MongLong0214/commitlore
+git clone --depth 1 --branch v1.2.1 https://github.com/MongLong0214/commitlore
 node commitlore/dist/commitlore.mjs --version
 ```
 
@@ -109,13 +109,13 @@ preserve, not for narrating every change.
 macOS and Linux:
 
 ```bash
-curl -fsSL https://raw.githubusercontent.com/MongLong0214/commitlore/v1.2.0/install.sh | sh -s v1.2.0
+curl -fsSL https://raw.githubusercontent.com/MongLong0214/commitlore/v1.2.1/install.sh | sh -s v1.2.1
 ```
 
 Windows:
 
 ```powershell
-& ([scriptblock]::Create((irm https://raw.githubusercontent.com/MongLong0214/commitlore/v1.2.0/install.ps1))) v1.2.0
+& ([scriptblock]::Create((irm https://raw.githubusercontent.com/MongLong0214/commitlore/v1.2.1/install.ps1))) v1.2.1
 ```
 
 Requires Node.js 22.23.2+ and Git. The script checks both before it writes anything.
@@ -242,7 +242,7 @@ per-record user command.
 
 ## A field report, not a measurement
 
-One run, on an unrelated repository, by someone installing v1.2.0 for the first
+One run, on an unrelated repository, by someone installing v1.2.1 for the first
 time. Nothing here was measured and none of it is in the evidence logs. It is on
 this page because the paragraph above asserts a loop that no table here covers.
 

README.zh-CN.md

@@ -47,18 +47,18 @@
 </p>
 
 ```bash
-curl -fsSL https://raw.githubusercontent.com/MongLong0214/commitlore/v1.2.0/install.sh | sh -s v1.2.0
+curl -fsSL https://raw.githubusercontent.com/MongLong0214/commitlore/v1.2.1/install.sh | sh -s v1.2.1
 ```
 
 <details>
 <summary>想先阅读安装器吗？</summary>
 
 ```bash
-curl -fsSLO https://raw.githubusercontent.com/MongLong0214/commitlore/v1.2.0/install.sh
-sh install.sh v1.2.0
+curl -fsSLO https://raw.githubusercontent.com/MongLong0214/commitlore/v1.2.1/install.sh
+sh install.sh v1.2.1
 
 # 或者跳过脚本：它创建的检出，你自己也能创建。
-git clone --depth 1 --branch v1.2.0 https://github.com/MongLong0214/commitlore
+git clone --depth 1 --branch v1.2.1 https://github.com/MongLong0214/commitlore
 node commitlore/dist/commitlore.mjs --version
 ```
 
@@ -105,13 +105,13 @@ CommitLore 把那份判断留在代码旁边。
 macOS 和 Linux：
 
 ```bash
-curl -fsSL https://raw.githubusercontent.com/MongLong0214/commitlore/v1.2.0/install.sh | sh -s v1.2.0
+curl -fsSL https://raw.githubusercontent.com/MongLong0214/commitlore/v1.2.1/install.sh | sh -s v1.2.1
 ```
 
 Windows：
 
 ```powershell
-& ([scriptblock]::Create((irm https://raw.githubusercontent.com/MongLong0214/commitlore/v1.2.0/install.ps1))) v1.2.0
+& ([scriptblock]::Create((irm https://raw.githubusercontent.com/MongLong0214/commitlore/v1.2.1/install.ps1))) v1.2.1
 ```
 
 需要 Node.js 22.23.2+ 和 Git。脚本会在写入任何内容前检查两者。
@@ -226,7 +226,7 @@ CommitLore 会问：
 
 ## 现场报告，不是测量
 
-这是某人在一个无关仓库首次安装 v1.2.0 时的一次运行。这里没有测量任何东西，也没有写进
+这是某人在一个无关仓库首次安装 v1.2.1 时的一次运行。这里没有测量任何东西，也没有写进
 evidence log。之所以放在这里，是因为上段主张了一种本页表格未覆盖的 loop。
 
 那个人让 agent 修复一个舍入 bug，顺带提到 decimal library 已经考虑过又被否决，最后说“commit it”。