From a5214e7e57c9429db28aabcf387bfacec562cb9c Mon Sep 17 00:00:00 2001
From: MULHAM <mulhamna@gmail.com>
Date: Thu, 13 Aug 2026 17:17:02 +0700
Subject: [PATCH 1/2] ci: switch npm publish to OIDC trusted publishing

NPM_TOKEN secret was long-lived and required manual rotation. npm
trusted publishing lets GitHub Actions authenticate via short-lived
OIDC tokens and attaches provenance automatically, so the workflow no
longer needs a stored secret.
---
 .github/workflows/npm-publish.yml | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml
index 256ebd0..5d208c3 100644
--- a/.github/workflows/npm-publish.yml
+++ b/.github/workflows/npm-publish.yml
@@ -16,6 +16,9 @@ jobs:
   publish:
     name: Publish package from GitHub release
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
 
     steps:
       - name: Checkout
@@ -50,8 +53,6 @@ jobs:
 
       - name: Publish to npm (skip if already published)
         shell: bash
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: |
           PACKAGE_VERSION=$(node -p "require('./package.json').version")
           PUBLISHED=$(npm view @mulham28/pkgmap@$PACKAGE_VERSION version 2>/dev/null || true)
@@ -62,4 +63,4 @@ jobs:
           fi
 
           echo "Publishing version $PACKAGE_VERSION..."
-          npm publish --access public
+          npm publish --access public --provenance

From d2883785ee7bd7a52db6a45201fd2154eb26f37a Mon Sep 17 00:00:00 2001
From: MULHAM <mulhamna@gmail.com>
Date: Thu, 13 Aug 2026 17:21:42 +0700
Subject: [PATCH 2/2] fix: bump brace-expansion to patch high-severity DoS
 advisory

npm audit flagged GHSA-rgw5-rvv9-x895 on the transitive
brace-expansion dep, failing the Dependency audit CI job.
---
 package-lock.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 4096903..c166887 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -300,9 +300,9 @@
       }
     },
     "node_modules/brace-expansion": {
-      "version": "5.0.8",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.8.tgz",
-      "integrity": "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==",
+      "version": "5.0.9",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
+      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {