fix(security): keep Unicode generation offline - #53
Merged
Conversation
CodeinScrubs
marked this pull request as ready for review
August 13, 2026 13:42
CodeinScrubs
added a commit
that referenced
this pull request
Aug 13, 2026
## What changed Prepare all 12 aligned `@bidilens/*` packages for the `0.3.1` patch release. This consumes the two reviewed Changesets, regenerates package changelogs and the bundled GitHub Action, aligns the private root/demo/citation metadata, and updates current-release documentation without claiming that npm publication has already happened. ## Why The fixes merged in #49, #52, and #53 are present on `main`, but npm consumers still receive `0.3.0`. The installable `0.3.1` artifacts carry the direction-evidence correction for ordinary hyphenated and all-capital prose, the linear raw-math scanner, and bounded Unicode range writes. The same source release also records the repository-only hardening that keeps Unicode table generation offline against vendored, checksum-pinned inputs. ## Developer impact - All public packages remain fixed-version and ESM-only. - No public API or production dependency changes are introduced by this versioning commit. - The packed adapters retain the pure-LTR no-op contract. - npm remains unchanged until a separate protected workflow receives an explicit human release decision. ## Evidence - [x] `pnpm run check`: 401/401 tests, 932 cross-platform corpus cases, types, lint, docs, builds, and Action checks passed. - [x] Coverage: 92.03% statements, 86.01% branches, 94.78% functions, 94.86% lines. - [x] `pnpm run test:visual`: Chromium, Firefox, and WebKit snapshots passed. - [x] `pnpm run packages:types`: all 12 packed type/export layouts passed. - [x] `pnpm run deps:audit`: no known vulnerabilities. - [x] CycloneDX 1.7 SBOM validated: 580 components and 594 dependency relationships. - [x] `pnpm run release:check`: all 12 tarballs installed and executed in clean consumers; all packed examples passed; bundle budgets passed. - [x] `pnpm run npm:release:dry-run -- --version 0.3.1`: all 12 coordinates are unused and ready; no registry mutation occurred. - [x] The release-preparation workflow's post-merge Changesets context was simulated with `changeset status --since HEAD` and passed. ## Security and language review The release preserves source strings, selection/copy order, caller-owned alignment, strict hidden-control auditing, and offline runtime behavior. The 932-case corpus is technically reviewed or user-provided; it is not represented as native-speaker certification. Publication remains isolated behind the protected `npm-release` environment, OIDC trusted publishing, exact version matching, immutable-version rejection, provenance, and the exact human confirmation phrase.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
unicode:generateandunicode:checkfully offline against the two vendored Unicode 17 filesWhy
The default-branch CodeQL run correctly kept one
js/http-to-file-accessalert open after PR #52: the optional maintenance command fetched remote response bytes and wrote them to disk. Paths and checksums were repository constants, so the path was bounded, but the strongest production posture is to have no network-to-filesystem path in the generator at all.The tradeoff is deliberate: a future Unicode-version upgrade requires maintainers to download and verify the two source files outside the repository before replacing the vendored copies. Normal users, CI, builds, and generation remain offline and reproducible.
Validation
pnpm run check: 16 files / 401 tests, 932-case corpus, docs, packages, and Action passedpnpm run release:check: all 12 packed packages, examples, clean consumer, CLI runtime, and size budgets passedgit diff --checkpassedThis PR targets the one remaining medium default-branch CodeQL finding. No alert will be dismissed as a substitute for a clean scan.