Release CodeTruss CLI v0.2.46 - #42

Syncs the 0.2.46 source from the private monorepo, byte for byte against the monorepo git objects (201 files compared by blob hash, 0 mismatches). Closes the four open Dependabot alerts on this repository.

codetruss-cli-0.2.46.tgz
sha256 047dc9915d8c0594c913d1c29813edeecb7c71b0fd4e594ab0221139955ad643

That digest was not copied into release-reference.json: pnpm release:artifact was run against this tree, resolved from this repository's own lockfile, and the rebuilt archive cmps clean against the monorepo's copy — as does the bundle inside it. The same cmp against 0.2.45 exits 1, so the comparison is capable of failing.

What 0.2.46 is

--allow and --deny are matched with minimatch, which expands brace groups through brace-expansion, and the bundled copy was 5.0.7. That version caps the number of expansions at 100,000 but not their length. {a,b} repeated a few hundred times keeps the count under the cap while making every result as long as the pattern has groups, and the arrays built while combining them exhaust the heap and abort the process — uncatchably, so try/catch does not help.

It is reachable here, which is the part worth saying plainly. allow and deny are read from the scanned repository's .codetruss.yml and validated only as a list of non-empty strings, so the pattern does not have to come from the operator. Two fresh fixtures, byte-identical .codetruss.yml carrying one 7.5 KB glob:

PUBLISHED 0.2.45   exit 134   allocation failure at 4075 MB   receipts written: 0
NEW       0.2.46   exit 1     REVIEW_REQUIRED                 receipts written: 4

What it is not. Nothing is disclosed, nothing is altered, and no verdict changes. A pattern cannot reach the matcher from a diff, a filename, or the network — only from flags you typed or a config file in the tree you pointed the CLI at. The worst outcome was a local tool dying instead of reporting. This is a real fix rather than a hygiene bump, and it is also not an emergency.

What moved

No overrides were added. minimatch moved as a declared dependency (^10.0.3 → ^10.2.6), and its own ^5.0.8 requirement means brace-expansion can no longer resolve below the patched line — the floor lives in the dependency graph rather than in a pin someone has to remember. postcss and nanoid re-resolved within the ranges vite already declares.

Proof the upgrade reached the bundle

A green lockfile with a stale bundle is the exact false pass this project exists to prevent, so the bundle was checked directly. 5.0.9-only sentinels in the built cli.cjs: EXPANSION_MAX_LENGTH ×2, 4e6 ×1, maxLength ×18, dropEmpties ×10, function combine( ×1. 5.0.7's expand_(str,max,isTop) signature: 0 occurrences. postcss, nanoid and source-map-js: 0 occurrences each, confirming those two are dev-only. And the behavioral result above, which is what actually settles it.

Scope matching is unchanged

The one thing a dependency bump under the file-scoping logic could do is silently change which files land in scope. 1938 (path, pattern) pairs — real globs, brace-heavy globs, numeric and alpha sequences, escapes, dotfiles, globstars, character classes — evaluated with {dot:true} under minimatch 10.2.5 + brace-expansion 5.0.7 and under 10.2.6 + 5.0.9. Zero divergence. 51 raw expand() calls compared directly: identical output. policy-verdict, policy-fingerprint, scope-inference and config all pass.

Not touched

pnpm-workspace.yaml and .npmrc are unchanged. public/downloads/grammars/ is carried verbatim, and no previously published artifact is modified — codetruss-cli-0.2.45.tgz is still 0ced9ca9….

Checked locally before opening

pnpm validate passes against this branch: typecheck, release:artifact, pnpm test (34 files, 425 tests), release:verify, and test:install. The rebuilt archive reproduced 047dc991… exactly, and release-reference.json's three digests were each recomputed from the files rather than transcribed.

🤖 Generated with Claude Code