Fission-AI/OpenSpec v1.14.3

v1.14.3 - Linked specs, safer globs

on GitHub

What's New in v1.14.3

This release accepts spec files linked from elsewhere in your project, removes a dependency that kept failing security audits, and fixes a validate hang in pre-commit hooks.

Improved

• No more braces audit warning - Installing OpenSpec no longer pulls in the unpatched braces package, so npm audit in your project stops reporting GHSA-vfj7-8cjw-p6xm through OpenSpec.
• Glob artifacts stay inside the change - The propose, ff, continue and explore workflows now choose and check a glob artifact's file path before anything writes it, including a skill or command the schema delegates creation to. A path that would leave the change directory, directly or through a symlink, is refused.

Fixed

• Linked spec files - A capability's spec.md can be a symlink to a file elsewhere in the project, such as beside the product docs it belongs to. list --specs, show, validate and archive accept it; a link that resolves outside the project is still refused.
• validate --all hanging in hooks - On a terminal that reports zero columns, as some pre-commit runners provide, the spinner no longer loops forever writing cursor escapes. OPEN_SPEC_INTERACTIVE=0 and CI now turn the spinner off too.
• Very wide brace patterns - A generates pattern whose braces expand to more than 1,024 paths is rejected with a clear error instead of running openspec status out of memory.

New Contributors

• @CRYPTONIKAV made their first contribution in #2104
• @surlymochan made their first contribution in #2103

Full Changelog: v1.14.2...v1.14.3