Repository navigation
Backfill the missing 0.4.0 CHANGELOG section - #51
Merged
Merged
Conversation
The 0.4.0 release was published to npm (core/cli/sdk) but never received a CHANGELOG entry; the file jumped from 0.5.0 straight to 0.3.1. Reconstruct the section from the v0.3.1..v0.4.0 history: 0.4.0 was the public-OSS hardening release (quality and security CI, OIDC trusted publishing, Dependabot, ASCII-commit enforcement, contributor governance, identifier sanitization, dependency and tooling bumps), with no CLI surface or data-format changes. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The dependabot and release workflow comments still referenced an internal planning identifier (Codex W2) that the 0.4.0 identifier sanitization missed, because the CI leak guard excludes workflow files. Drop it, leaving the plain "supply-chain hardening" rationale. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Backfill the missing 0.4.0 entry in CHANGELOG.md -- the file jumped from 0.5.0
straight to 0.3.1 even though 0.4.0 is published on npm -- plus a small
identifier-hygiene fix surfaced while reconstructing it. Follow-up to the docs
sweep (#50).
0.4.0 reconstruction
0.4.0 (tag 2026-05-27) was the public-OSS hardening release. Reconstructed from
the
v0.3.1..v0.4.0history and verified against each commit:(npm provenance + cosign-signed GitHub Release); Dependabot; ASCII-commit
enforcement.
the release checklist, and the bare-name redirect package prep.
tightening; identifier and non-English comment sanitization.
Codex W2 scrub (second commit)
The adversarial review of the reconstruction found that two tracked workflow
comments (
.github/dependabot.yml,.github/workflows/release.yml) stillcarried an internal planning identifier (
Codex W2) that the 0.4.0sanitization missed, because the CI leak guard excludes workflow files. Removed,
leaving the plain "supply-chain hardening" rationale.
Notes
OIDC/cosign scope, the not-yet-enabled GitHub private vulnerability reporting
channel, and the Tests-note style were folded in.
## Unreleasedentry for this PR itself, per repo convention (this IS aCHANGELOG fix).