Security fixes and dependency updates (2.1.4)

.lefthook/pre-push/verify-version-functions.sh

@@ -0,0 +1,81 @@
+#!/bin/sh
+
+# Read package name from .packagename file
+get_package_name() {
+  cat .packagename
+}
+
+# Extract version field from package.json staged version
+get_full_version() {
+  local package_name="$1"
+  git show :packages/$package_name/package.json | node -p "JSON.parse(require('fs').readFileSync(0)).version"
+}
+
+# Read CHANGELOG.md content from staged version
+get_changelog() {
+  git show :CHANGELOG.md
+}
+
+# Extract base version (x.y.z) from full version (x.y.z-preview.n)
+get_base_version() {
+  local full_version="$1"
+  echo "$full_version" | sed 's/^\([0-9]\+\.[0-9]\+\.[0-9]\+\).*/\1/'
+}
+
+# Extract all version numbers from changelog headers in semver order (highest first)
+get_changelog_versions() {
+  local changelog="$1"
+  local document_versions=$(echo "$changelog" | grep -o "^## \[[0-9]\+\.[0-9]\+\.[0-9]\+\]" | sed 's/## \[\(.*\)\]/\1/')
+  local sorted_versions=$(echo "$document_versions" | sort -V -r)
+
+  if [ "$document_versions" != "$sorted_versions" ]; then
+    return 1
+  fi
+
+  echo "$document_versions"
+  return 0
+}
+
+# Verify version header exists with proper date format (## [x.y.z] - YYYY-MM-DD)
+check_version_header() {
+  local changelog="$1"
+  local base_version="$2"
+  local full_version="$3"
+
+  # Get first version from changelog
+  local first_version=$(echo "$changelog" | grep -o "^## \[[0-9]\+\.[0-9]\+\.[0-9]\+\]" | sed 's/## \[\(.*\)\]/\1/' | head -n 1)
+
+  # Check if package version matches first changelog entry
+  if [ "$base_version" != "$first_version" ]; then
+    echo "Error: Package version [$base_version] is not the first changelog entry (first entry: [$first_version])" >&2
+    return 1
+  fi
+
+  echo "$changelog" | egrep -q "^## \[$base_version\] - [0-9]{4}-[0-9]{2}-[0-9]{2}\$"
+  if [ $? -ne 0 ]; then
+    echo "Error: Version header [$base_version] not found in CHANGELOG.md (package version: $full_version)" >&2
+    return 1
+  fi
+}
+
+# Verify all version headers have corresponding GitHub release tag link definitions
+check_version_links() {
+  local changelog="$1"
+  local package_name="$2"
+  local versions=$(get_changelog_versions "$changelog")
+
+  local link_versions=$(echo "$changelog" | grep -o "^\[[0-9]\+\.[0-9]\+\.[0-9]\+\]:" | sed 's/^\[\(.*\)\]:/\1/')
+
+  if [ "$versions" != "$link_versions" ]; then
+    echo "Error: Version links are not in the same order as changelog headers" >&2
+    return 1
+  fi
+
+  for v in $versions; do
+    echo "$changelog" | egrep -q "^\[$v\]: https://github.com/shellicar/$package_name/releases/tag/$v\$"
+    if [ $? -ne 0 ]; then
+      echo "Error: Missing or invalid link definition for version [$v]" >&2
+      return 1
+    fi
+  done
+}

.lefthook/pre-push/verify-version.sh

@@ -0,0 +1,17 @@
+#!/bin/sh
+set -e
+
+SCRIPT_DIR=$(dirname "$0")
+. "$SCRIPT_DIR/verify-version-functions.sh"
+
+main() {
+  local package_name=$(get_package_name) || exit $?
+  local full_version=$(get_full_version "$package_name") || exit $?
+  local changelog=$(get_changelog) || exit $?
+  local base_version=$(get_base_version "$full_version")
+
+  check_version_header "$changelog" "$base_version" "$full_version"
+  check_version_links "$changelog" "$package_name"
+}
+
+main

CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## [2.1.4] - 2026-02-28
+
+### Security
+
+- Fixed [CVE-2026-25547](https://github.com/advisories/GHSA-7h2j-956f-4vf2) in @isaacs/brace-expansion
+- Fixed [CVE-2026-26996](https://github.com/advisories/GHSA-3ppc-4f35-3m26) in minimatch
+
+### Changed
+
+- Updated @shellicar/build-clean to 1.2.3, biome to 2.4.4
+- Updated all dependencies to latest versions
+
 ## [2.1.3] - 2026-01-20
 
 ### Fixed
@@ -77,6 +89,7 @@
 
 Initial release.
 
+[2.1.4]: https://github.com/shellicar/core-config/releases/tag/2.1.4
 [2.1.3]: https://github.com/shellicar/core-config/releases/tag/2.1.3
 [2.1.2]: https://github.com/shellicar/core-config/releases/tag/2.1.2
 [2.1.1]: https://github.com/shellicar/core-config/releases/tag/2.1.1

biome.json

@@ -1,5 +1,5 @@
 {
-  "$schema": "https://biomejs.dev/schemas/2.3.10/schema.json",
+  "$schema": "https://biomejs.dev/schemas/2.3.14/schema.json",
   "vcs": {
     "enabled": true,
     "clientKind": "git",

examples/cjs/package.json

@@ -10,13 +10,13 @@
   },
   "dependencies": {
     "@shellicar/core-config": "workspace:^",
-    "zod": "^4.2.1"
+    "zod": "^4.3.6"
   },
   "devDependencies": {
-    "@shellicar/build-clean": "1.1.2",
-    "@tsconfig/node20": "^20.1.8",
-    "@types/node": "^25.0.3",
-    "terser": "^5.44.1",
+    "@shellicar/build-clean": "^1.2.3",
+    "@tsconfig/node20": "^20.1.9",
+    "@types/node": "^25.3.2",
+    "terser": "^5.46.0",
     "tsup": "^8.5.1",
     "tsx": "^4.21.0",
     "typescript": "^5.9.3"

examples/esm/package.json

@@ -10,13 +10,13 @@
   },
   "dependencies": {
     "@shellicar/core-config": "workspace:^",
-    "zod": "^4.2.1"
+    "zod": "^4.3.6"
   },
   "devDependencies": {
-    "@shellicar/build-clean": "1.1.2",
-    "@tsconfig/node20": "^20.1.8",
-    "@types/node": "^25.0.3",
-    "terser": "^5.44.1",
+    "@shellicar/build-clean": "^1.2.3",
+    "@tsconfig/node20": "^20.1.9",
+    "@types/node": "^25.3.2",
+    "terser": "^5.46.0",
     "tsup": "^8.5.1",
     "tsx": "^4.21.0",
     "typescript": "^5.9.3"

examples/readme/package.json

@@ -9,8 +9,8 @@
     "type-check": "tsc -p tsconfig.check.json"
   },
   "devDependencies": {
-    "@tsconfig/node20": "^20.1.8",
-    "@types/node": "^25.0.3",
+    "@tsconfig/node20": "^20.1.9",
+    "@types/node": "^25.3.2",
     "tsup": "^8.5.1",
     "tsx": "^4.21.0",
     "typescript": "^5.9.3"

examples/zod-config/package.json

@@ -10,11 +10,11 @@
   },
   "dependencies": {
     "@shellicar/core-config": "workspace:^",
-    "zod": "^4.2.1"
+    "zod": "^4.3.6"
   },
   "devDependencies": {
-    "@tsconfig/node20": "^20.1.8",
-    "@types/node": "^25.0.3",
+    "@tsconfig/node20": "^20.1.9",
+    "@types/node": "^25.3.2",
     "tsup": "^8.5.1",
     "tsx": "^4.21.0",
     "typescript": "^5.9.3"

lefthook.yml

@@ -6,6 +6,8 @@ pre-commit:
 pre-push:
   commands:
     check:
-      run: pnpm biome ci --diagnostic-level=error --no-errors-on-unmatched --colors=off {push_files}
-    version-check:
-      run: pnpm verify-version
+      files: git diff --name-only origin/main...HEAD
+      run: pnpm biome ci --diagnostic-level=error --no-errors-on-unmatched --colors=off {files}
+  scripts:
+    'verify-version.sh':
+      runner: sh

package.json

@@ -1,6 +1,6 @@
 {
   "private": true,
-  "packageManager": "pnpm@10.26.2+sha512.0e308ff2005fc7410366f154f625f6631ab2b16b1d2e70238444dd6ae9d630a8482d92a451144debc492416896ed16f7b114a86ec68b8404b2443869e68ffda6",
+  "packageManager": "pnpm@10.30.3+sha512.c961d1e0a2d8e354ecaa5166b822516668b7f44cb5bd95122d590dd81922f606f5473b6d23ec4a5be05e7fcd18e8488d47d978bbe981872f1145d06e9a740017",
   "scripts": {
     "build": "turbo run build",
     "dev": "turbo run dev",
@@ -19,10 +19,10 @@
     "verify-version": "./scripts/verify-version.sh"
   },
   "devDependencies": {
-    "@biomejs/biome": "^2.3.10",
-    "lefthook": "^2.0.13",
-    "npm-check-updates": "^19.2.0",
+    "@biomejs/biome": "^2.4.4",
+    "lefthook": "^2.1.1",
+    "npm-check-updates": "^19.6.2",
     "syncpack": "^13.0.4",
-    "turbo": "^2.7.2"
+    "turbo": "^2.8.12"
   }
 }

packages/core-config/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@shellicar/core-config",
   "private": false,
-  "version": "2.1.3",
+  "version": "2.1.4",
   "type": "module",
   "license": "MIT",
   "author": "Stephen Hellicar",
@@ -59,12 +59,12 @@
     "type-check": "tsc -p tsconfig.check.json"
   },
   "devDependencies": {
-    "@shellicar/build-clean": "1.1.2",
-    "@tsconfig/node20": "^20.1.8",
-    "@types/node": "^25.0.3",
-    "terser": "^5.44.1",
+    "@shellicar/build-clean": "^1.2.3",
+    "@tsconfig/node20": "^20.1.9",
+    "@types/node": "^25.3.2",
+    "terser": "^5.46.0",
     "tsup": "^8.5.1",
     "typescript": "^5.9.3",
-    "vitest": "^4.0.16"
+    "vitest": "^4.0.18"
   }
 }