From 8bf2a808f4fccbf60459abbf8e92b3524c119359 Mon Sep 17 00:00:00 2001 From: Alexander Tartmin Date: Thu, 22 Oct 2026 22:20:38 +0300 Subject: [PATCH] chore(release): prepare 0.1.0-beta.12 --- AGENTS.md | 2 +- CHANGELOG.md | 11 ++++++++++- README.md | 4 ++-- docs/src/content/docs/index.mdx | 2 +- .../content/docs/project/release-integrity.md | 16 ++++++++-------- .../docs/reference/apple-compatibility.md | 2 +- package-lock.json | 4 ++-- package.json | 2 +- tests/consumer-smoke/package-lock.json | 4 ++-- 9 files changed, 28 insertions(+), 19 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index 4b2f2f6..267c374 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -4,7 +4,7 @@ This file is the durable engineering context for humans and coding agents workin ## Product intent -Build a small, framework-agnostic, server-side TypeScript core for Apple Profile Service profile generation, optional signing, CMS response verification, and lossless response parsing. The current release target is `0.1.0-beta.11` under the npm scope `@udid-tools`. +Build a small, framework-agnostic, server-side TypeScript core for Apple Profile Service profile generation, optional signing, CMS response verification, and lossless response parsing. The current release target is `0.1.0-beta.12` under the npm scope `@udid-tools`. MDM is a separate product boundary. Do not add MDM enrollment, APNs, check-in, commands, declarative management, SCEP orchestration, profile delivery state machines, HTTP servers, persistence, or UI code here. A future MDM package may reuse stable low-level primitives without changing this package’s Profile Service contract. diff --git a/CHANGELOG.md b/CHANGELOG.md index e055b2e..48ed0c8 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,12 @@ Versioning]. Prereleases use npm's `beta` distribution tag. ## [Unreleased] +## [0.1.0-beta.12] - 2026-10-22 + +### Changed + +- Updated pinned GitHub Actions used by security analysis and OpenSSF Scorecard workflows. + ### Fixed - Accept password-encrypted PKCS#12 certificate safe contents and private-key bags produced with @@ -16,6 +22,8 @@ Versioning]. Prereleases use npm's `beta` distribution tag. - Bound PKCS#12 MAC and encryption KDF iteration counts before key derivation, and reject unknown KDF, PRF, cipher, salt-source, IV, and key-length parameters with sanitized errors. +- Updated the development-only Vitest and Markdown-it toolchain to patched releases, resolving + audit advisories without changing runtime dependencies. ## [0.1.0-beta.11] - 2026-10-17 @@ -148,7 +156,8 @@ Versioning]. Prereleases use npm's `beta` distribution tag. [keep a changelog]: https://keepachangelog.com/en/1.1.0/ [semantic versioning]: https://semver.org/spec/v2.0.0.html -[unreleased]: https://github.com/udid-tools/core/compare/v0.1.0-beta.11...HEAD +[unreleased]: https://github.com/udid-tools/core/compare/v0.1.0-beta.12...HEAD +[0.1.0-beta.12]: https://github.com/udid-tools/core/compare/v0.1.0-beta.11...v0.1.0-beta.12 [0.1.0-beta.11]: https://github.com/udid-tools/core/compare/v0.1.0-beta.10...v0.1.0-beta.11 [0.1.0-beta.10]: https://github.com/udid-tools/core/compare/v0.1.0-beta.9...v0.1.0-beta.10 [0.1.0-beta.9]: https://github.com/udid-tools/core/compare/v0.1.0-beta.8...v0.1.0-beta.9 diff --git a/README.md b/README.md index e88c18c..47e37d2 100644 --- a/README.md +++ b/README.md @@ -11,7 +11,7 @@ Security-first TypeScript primitives for Apple Profile Service profiles: generate XML, optionally produce attached CMS/PKCS#7 SignedData, verify device responses, and parse every returned plist field without losing unknown data. -> **Beta:** `0.1.0-beta.11` is ready for evaluation. Its public API follows semantic versioning, but beta releases may still contain breaking changes. MDM is intentionally out of scope. +> **Beta:** `0.1.0-beta.12` is ready for evaluation. Its public API follows semantic versioning, but beta releases may still contain breaking changes. MDM is intentionally out of scope. ## Install @@ -101,7 +101,7 @@ The default verification mode checks RSA/SHA-1 and RSA/SHA-256 signature integri ## Capability matrix -| Capability | `0.1.0-beta.11` | +| Capability | `0.1.0-beta.12` | | ------------------------------------------- | ---------------------------------------------------------------------------------- | | Apple Profile Service payload | Supported | | Documented attributes | `UDID`, `VERSION`, `PRODUCT`, `SERIAL`, `MEID`, `IMEI`, `ICCID`, `MAC_ADDRESS_EN0` | diff --git a/docs/src/content/docs/index.mdx b/docs/src/content/docs/index.mdx index 340cee8..1b94d24 100644 --- a/docs/src/content/docs/index.mdx +++ b/docs/src/content/docs/index.mdx @@ -75,5 +75,5 @@ Signing is selected by providing a complete nested `signing` object. Parsing ver - Read the [security model](/core/concepts/security-model/) before exposing an endpoint to the internet. :::caution[Beta software] -Version `0.1.0-beta.11` supports PKCS#12 RSA identities with SHA-256. Review the capability matrix before using the package in production. +Version `0.1.0-beta.12` supports PKCS#12 RSA identities with SHA-256. Review the capability matrix before using the package in production. ::: diff --git a/docs/src/content/docs/project/release-integrity.md b/docs/src/content/docs/project/release-integrity.md index 4c38f7a..f080cbf 100644 --- a/docs/src/content/docs/project/release-integrity.md +++ b/docs/src/content/docs/project/release-integrity.md @@ -17,34 +17,34 @@ Each GitHub Release contains: The workflow also records a GitHub artifact attestation for the tarball. npm Trusted Publishing adds registry provenance without a long-lived npm token. -## Verify version 0.1.0-beta.11 +## Verify version 0.1.0-beta.12 Download the immutable release assets: ```bash -gh release download v0.1.0-beta.11 --repo udid-tools/core --dir core-release +gh release download v0.1.0-beta.12 --repo udid-tools/core --dir core-release cd core-release ``` Verify the tarball checksum on Linux: ```bash -sha256sum --check udid-tools-core-0.1.0-beta.11.tgz.sha256 +sha256sum --check udid-tools-core-0.1.0-beta.12.tgz.sha256 ``` On macOS, use the compatible checksum command: ```bash -shasum --algorithm 256 --check udid-tools-core-0.1.0-beta.11.tgz.sha256 +shasum --algorithm 256 --check udid-tools-core-0.1.0-beta.12.tgz.sha256 ``` Verify the tarball's keyless Sigstore signature, certificate identity, and transparency-log proof: ```bash -cosign verify-blob udid-tools-core-0.1.0-beta.11.tgz \ - --bundle udid-tools-core-0.1.0-beta.11.tgz.sigstore.json \ +cosign verify-blob udid-tools-core-0.1.0-beta.12.tgz \ + --bundle udid-tools-core-0.1.0-beta.12.tgz.sigstore.json \ --certificate-identity \ - "https://github.com/udid-tools/core/.github/workflows/release.yml@refs/tags/v0.1.0-beta.11" \ + "https://github.com/udid-tools/core/.github/workflows/release.yml@refs/tags/v0.1.0-beta.12" \ --certificate-oidc-issuer "https://token.actions.githubusercontent.com" ``` @@ -52,7 +52,7 @@ Repeat `cosign verify-blob` with each SBOM or checksum file and its adjacent bun those assets directly. Verify the GitHub artifact attestation independently: ```bash -gh attestation verify udid-tools-core-0.1.0-beta.11.tgz \ +gh attestation verify udid-tools-core-0.1.0-beta.12.tgz \ --repo udid-tools/core ``` diff --git a/docs/src/content/docs/reference/apple-compatibility.md b/docs/src/content/docs/reference/apple-compatibility.md index 88ffbcd..05e79ab 100644 --- a/docs/src/content/docs/reference/apple-compatibility.md +++ b/docs/src/content/docs/reference/apple-compatibility.md @@ -9,7 +9,7 @@ The special Profile Service protocol is primarily documented in Apple’s archiv 2. **Observed:** verified on specified platform versions with reproducible fixtures. 3. **Extension:** accepted losslessly but not yet normalized or claimed as Apple-defined. -`0.1.0-beta.11` types the documented attribute names `UDID`, `VERSION`, `PRODUCT`, `SERIAL`, `MEID`, `IMEI`, `ICCID`, and `MAC_ADDRESS_EN0`. Availability depends on device hardware, OS, privacy behavior, and enrollment context. A requested value is not automatically guaranteed. +`0.1.0-beta.12` types the documented attribute names `UDID`, `VERSION`, `PRODUCT`, `SERIAL`, `MEID`, `IMEI`, `ICCID`, and `MAC_ADDRESS_EN0`. Availability depends on device hardware, OS, privacy behavior, and enrollment context. A requested value is not automatically guaranteed. Apple Profile Service responses may use RSA/SHA-1. Apple's archived guide requires a signed CMS response but does not prescribe the digest algorithm. Response verification accepts both RSA/SHA-1 and RSA/SHA-256. diff --git a/package-lock.json b/package-lock.json index b24d4fe..2aa8424 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "@udid-tools/core", - "version": "0.1.0-beta.11", + "version": "0.1.0-beta.12", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "@udid-tools/core", - "version": "0.1.0-beta.11", + "version": "0.1.0-beta.12", "license": "MIT", "dependencies": { "asn1js": "3.0.10", diff --git a/package.json b/package.json index f9b717f..af170cc 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@udid-tools/core", - "version": "0.1.0-beta.11", + "version": "0.1.0-beta.12", "description": "Framework-agnostic TypeScript SDK for Apple Profile Service profiles, CMS signing, verification, and device response parsing.", "keywords": [ "apple", diff --git a/tests/consumer-smoke/package-lock.json b/tests/consumer-smoke/package-lock.json index d5ce8d5..b49d1f2 100644 --- a/tests/consumer-smoke/package-lock.json +++ b/tests/consumer-smoke/package-lock.json @@ -12,9 +12,9 @@ } }, "node_modules/@udid-tools/core": { - "version": "0.1.0-beta.11", + "version": "0.1.0-beta.12", "resolved": "file:udid-tools-core.tgz", - "integrity": "sha512-8gOyk3WxPmofqo2VsTHS5ok0c5491zOmjO8FWr3wP96z1VlVID2375XW8+Zxt/40VZZkOgPHniHdR6B32MFX4A==", + "integrity": "sha512-58zn/bRKSt7ZRoP7sJqEMN6oEl586cYbBJUr52fTqMwRjZ9oZrgXX/qL+QDIhnakYiCgzhBpkY3bUckf/d010w==", "dependencies": { "asn1js": "3.0.10", "fast-xml-parser": "5.11.2",