Source snapshot validated by the CI pipeline. This entry does not contain firmware bundles.
Changes:
weaver: release-range fixes + npm audit (mobile, dashboard, rvagent, ruview-cli) (#2468)
- fix(pose-fusion): mark vendored ruvector-attention-wasm copy private
ui/pose-fusion/pkg/ruvector-attention is a wasm-pack build of
ruvector-attention-wasm vendored for the browser demo; the npm package is
published from ruvnet/ruvector. The vendored manifest declared the same
name without "private", so RuView looked like a second publisher of that
name (release:name_collision). Marking it private means it can never be
npm-published from this repo. Runtime is unchanged: the demo loads the
files by relative path.
Co-Authored-By: claude-flow ruv@ruv.net
- fix(harness): bound @ruvnet/ruview-kernel peer range to ^0.1.0
">=0.1.0" accepted any future major of the optional kernel peer
(release:open_range). ^0.1.0 matches the 0.x line the bridge was written
against; the ruview umbrella already pins kernel 0.1.0 exactly.
Co-Authored-By: claude-flow ruv@ruv.net
- fix(mobile): refresh lockfile for npm audit advisories, raise axios floor
npm audit fix (no --force) on ui/mobile: critical 1 -> 0, high 20 -> 4
(prod tree: critical 1 -> 0, high 18 -> 4). Fixed include shell-quote
(critical), axios, @react-navigation/core, ws, node-forge, form-data,
js-yaml, lodash, nanoid, postcss, query-string and others. axios floor
raised to ^1.21.0 so the manifest no longer admits the vulnerable range.
Left, and why: @expo/cli, @xmldom/xmldom and zod need expo 58 (a major,
coupled to react-native); image-size sits under the nested metro 0.84.3
that RN/Expo pin, and its fix (2.0.3) changes the import shape metro uses.
image-size is a bundler dependency, not shipped in the app.
Pre-existing on main and unchanged here: strict npm ci fails on the
react 19.2.0 / react-dom 19.2.6 peer pair (install needs
--legacy-peer-deps), jest cannot load the react-native 0.85 preset
without @react-native/jest-preset, and tsc reports the same 5 errors.
Co-Authored-By: claude-flow ruv@ruv.net
- fix(dashboard): vitest 5 + vite 8 to clear critical dev-tool advisories
dashboard's production tree was already audit-clean; every finding was in
dev tooling. Critical: vitest (UI server file read/exec, mocker path
traversal) and tinypool (prototype pollution to RCE), fixed only in
vitest 5; vite <=6.4.3 high. npm audit: critical 2 -> 0, high 9 -> 0.
vite 8 (Rolldown) rejects the object form of manualChunks, so it becomes
the equivalent function; the build emits the same chunk set
(index, lit, signals, worker, css) and the same PWA precache.
Co-Authored-By: claude-flow ruv@ruv.net
- fix(rvagent): zod 4.6.7 and MCP SDK 1.32.2 to clear runtime advisories
@ruvnet/rvagent's published runtime admitted vulnerable versions:
zod <4.6.6 (memory exhaustion validating oversized constrained
collections, GHSA-mrhx-c7xc-m3w5; every tool call is parsed by zod) and
@modelcontextprotocol/sdk <=1.31.0 with its express, body-parser,
proxy-addr (critical) and hono chain. Floors raised to zod ^4.6.7 and
sdk ^1.32.2; ts-jest's handlebars (critical) fixed via the lockfile.
npm audit: critical 2 -> 0, high 9 -> 0 (prod: 1/6 -> 0/0).
zod 4 ships its own JSON Schema export, so zod-to-json-schema is dropped.
The conversion moves to src/json-schema.ts with io "input" (defaulted
fields stay optional) and an override that keeps plain objects closed,
as zod-to-json-schema advertised them. The advertised tools/list schemas
are unchanged apart from zod 4 adding a regex pattern next to
format: uuid. z.record now takes an explicit key schema.
tests/dependency-floor.test.ts fails on main (the suite does not compile
against zod 3) and passes here: installed and declared floors, closed
objects, defaulted fields optional.
Co-Authored-By: claude-flow ruv@ruv.net
- fix(ruview-cli): refresh lockfile for dev-tool npm audit advisories
Production tree was already clean. npm audit fix (no --force) clears
handlebars (critical, via ts-jest), brace-expansion, browserslist and
js-yaml: critical 1 -> 0, high 3 -> 0.
Co-Authored-By: claude-flow ruv@ruv.net
- chore(rvagent): 0.2.1
Publishes the zod / MCP SDK floor change so npm consumers stop resolving
the vulnerable versions.
Co-Authored-By: claude-flow ruv@ruv.net
- chore(harness): refresh content manifest for the kernel peer range
The harness manifest pins a hash of package.json; regenerated with
npm run manifest:update after the ^0.1.0 peer change.
Co-Authored-By: claude-flow ruv@ruv.net
Source commit: a913103052fb192da7bec69ee7d75b6afae51aa9
Container images publish separately through the sensing-server release workflow.
Firmware downloads are attached to the dedicated vX.Y.Z-esp32 releases.