From 6c015d2fd48905b1d21839e75a67c9dae41e0dad Mon Sep 17 00:00:00 2001 From: Aaron Phifer <191053702+aaronphifer@users.noreply.github.com> Date: Mon, 12 Oct 2026 22:19:55 -0400 Subject: [PATCH 1/2] release: prepare BB VariaQ plugin 0.6.1 - Bump package identity to 0.6.1 (package.json, package-lock.json, lib/schema.ts BB_PLUGIN_VARIAQ_VERSION, README package identity). - Add the 0.6.1 changelog section for the PR #11 maintenance fixes (structured CLI comparison errors, SECURITY.md advisory accuracy, regression coverage) and date the 0.6.0 section to its release date. - No compatibility, dependency, or functional changes; VariaQ 0.6.x, 0.8.x, and 0.8.0rc1 support is unchanged from 0.6.0. --- CHANGELOG.md | 15 ++++++++++----- README.md | 2 +- lib/schema.ts | 2 +- package-lock.json | 4 ++-- package.json | 2 +- 5 files changed, 15 insertions(+), 10 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 99770c6..aad7843 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,9 +2,17 @@ All notable changes to this project will be documented in this file. -## 0.6.0 - Unreleased +## 0.6.1 - 2026-10-12 -Unreleased compatibility update. +Maintenance release: review-findings fixes and regression coverage; no compatibility or functional changes. + +- Convert invalid `--compare` values on `bb variaq report-campaign`, `analyze-runs`, and `analyze-campaign` from an uncaught `ZodError` into structured `PluginError` CLI errors with valid-value hints, preserving valid-comparison behavior and output contracts. +- Correct the `SECURITY.md` dependency review to the current audit state: the `source-map-js` row is remediated by the 1.2.2 override, five development-only packages remain (three high, two moderate), and advisory lists per package are now complete with production dependencies still clean. +- Extend regression coverage: operation-level schema violations (e.g. exceeding the group-by limit) surface as structured CLI errors, and the fake VariaQ harness echoes the received `--compare` value into report envelopes/artifacts so tests prove the comparison selector is actually forwarded to the subprocess. + +## 0.6.0 - 2026-10-11 + +Compatibility release for VariaQ 0.8.0 on BB 0.46 / Plugin SDK 0.6.37. - Accept stable VariaQ 0.8.x series releases and the tested 0.8.0rc1 candidate while retaining 0.6.x and schema-v1 support; paired_solvers comparisons unlock on stable VariaQ 0.8.x. - Prepare an immutable stable VariaQ 0.8.0 integration CI leg (pin the stable tag SHA when the VariaQ stable branch is pushed). @@ -18,9 +26,6 @@ Unreleased compatibility update. - Document the development-toolchain audit findings separately from runtime dependencies. - Fix duplicated plot-format requests in `variaq_report_campaign` when both `formats: ["plots"]` and `plots: true` are supplied; `formats` is now canonical and `plots: true` only ensures "plots" appears once. -- Convert invalid `--compare` values on `bb variaq report-campaign`, `analyze-runs`, and `analyze-campaign` from an uncaught `ZodError` into structured `PluginError` CLI errors with valid-value hints, preserving valid-comparison behavior and output contracts. -- Correct the `SECURITY.md` dependency review to the current audit state: the `source-map-js` row is remediated by the 1.2.2 override, five development-only packages remain (three high, two moderate), and advisory lists per package are now complete with production dependencies still clean. -- Extend regression coverage: operation-level schema violations (e.g. exceeding the group-by limit) surface as structured CLI errors, and the fake VariaQ harness echoes the received `--compare` value into report envelopes/artifacts so tests prove the comparison selector is actually forwarded to the subprocess. - Update GitHub Actions to Node 24-native action versions (`actions/checkout@v6`, `actions/setup-node@v7`, `actions/setup-python@v7`) to resolve Node 20 deprecation warnings while preserving existing workflow behavior. - Apply a compatible `overrides` remediation for npm audit findings in the `bb-app` development dependency chain; runtime dependencies remain clean. diff --git a/README.md b/README.md index c48e94c..fdf7954 100644 --- a/README.md +++ b/README.md @@ -192,7 +192,7 @@ does not authorize running an unverified version. The BB engine/SDK pins have moved from BB 0.43 / SDK 0.4.104 to the actual BB 0.46 host. Old BB 0.43 host compatibility is not claimed. Package identity is -`0.6.0` (unreleased); this work does not publish a plugin or a VariaQ release. +`0.6.1` (unreleased); this work does not publish a plugin or a VariaQ release. ### Paired-solver analysis in the 0.8 series diff --git a/lib/schema.ts b/lib/schema.ts index 6eef1d9..30a137e 100644 --- a/lib/schema.ts +++ b/lib/schema.ts @@ -188,7 +188,7 @@ export interface ParsedEnvelope { export const SUPPORTED_SCHEMA_VERSION = "1"; /** Compatibility metadata, mirrored here for the schema module. */ -export const BB_PLUGIN_VARIAQ_VERSION = "0.6.0"; +export const BB_PLUGIN_VARIAQ_VERSION = "0.6.1"; export const VERIFIED_VARIAQ_VERSION = "0.8.0"; export const SUPPORTED_VARIAQ_SERIES = "0.6.x, 0.8.x and 0.8.0rc1"; diff --git a/package-lock.json b/package-lock.json index bc45f46..11ff9ab 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "bb-plugin-variaq", - "version": "0.6.0", + "version": "0.6.1", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "bb-plugin-variaq", - "version": "0.6.0", + "version": "0.6.1", "license": "Apache-2.0", "dependencies": { "zod": "^4.3.6" diff --git a/package.json b/package.json index cfbc654..a8e123a 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "bb-plugin-variaq", - "version": "0.6.0", + "version": "0.6.1", "type": "module", "description": "Thin bb adapter for the standalone VariaQ hybrid-compute research platform.", "license": "Apache-2.0", From 919c7466ecb707e005fd73118102c4de04b18aa7 Mon Sep 17 00:00:00 2001 From: Aaron Phifer <191053702+aaronphifer@users.noreply.github.com> Date: Mon, 12 Oct 2026 22:26:34 -0400 Subject: [PATCH 2/2] docs: keep 0.6.1 changelog entry Unreleased until publication Address the Codex review finding: the pre-publication checkout must not record 0.6.1 with a release date while the README states it is unreleased. The date is applied to the entry at publication time, matching the 0.6.0 release flow. --- CHANGELOG.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index aad7843..4bc371b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,9 +2,9 @@ All notable changes to this project will be documented in this file. -## 0.6.1 - 2026-10-12 +## 0.6.1 - Unreleased -Maintenance release: review-findings fixes and regression coverage; no compatibility or functional changes. +Maintenance release: review-findings fixes and regression coverage; no compatibility or functional changes. The release date is applied to this entry at publication. - Convert invalid `--compare` values on `bb variaq report-campaign`, `analyze-runs`, and `analyze-campaign` from an uncaught `ZodError` into structured `PluginError` CLI errors with valid-value hints, preserving valid-comparison behavior and output contracts. - Correct the `SECURITY.md` dependency review to the current audit state: the `source-map-js` row is remediated by the 1.2.2 override, five development-only packages remain (three high, two moderate), and advisory lists per package are now complete with production dependencies still clean.