mirror of
https://github.com/prompt-security/clawsec.git
synced 2026-06-19 00:11:20 +03:00
davida-ps
4dbac421ab
* feat(advisories): add provisional ghsa feed * fix(workflows): include advisory signatures in checksums * fix(workflows): mirror ghsa feed at release root * feat(advisories): consolidate ghsa into agent feed * ci(advisories): consolidate ghsa during nvd poll * fix(advisories): retain unreplaced ghsa feed entries * chore(skills): bump advisory feed consumers * fix(release): resolve ts import closure dry run * fix(release): preserve urls while stripping comments * fix(release): ignore skill test-only changes * fix(advisories): follow ghsa pagination links * test(advisories): add nvd ghsa pipeline dry run
1.9 KiB
1.9 KiB
Changelog
[0.0.8] - 2026-05-24
Changed
- Documented the consolidated signed advisory feed as the default feed for NVD CVEs, approved community advisories, and provisional GHSA-without-CVE records.
[0.0.7] - 2026-05-14
Security
- Added explicit signed release artifact verification instructions for standalone installs, including
checksums.json,checksums.sig,signing-public.pem, archive hash verification, andSKILL.md/skill.jsonchecksum checks.
All notable changes to the ClawSec Feed skill will be documented in this file.
The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.
[0.0.6] - 2026-04-14
Added
- Operational notes in the skill docs that distinguish standalone feed installation from
clawsec-suiteautomation responsibilities. - Metadata describing required standalone install tooling and operator review expectations.
Changed
- Clarified that the standalone feed package does not itself create persistence, hooks, or cron jobs.
- Declared checksum/extraction tooling used by the documented install flow (
bash,shasum,unzip) in skill metadata. - Normalized product naming in the skill docs to use OpenClaw terminology.
Security
- Made release-provenance and checksum verification expectations explicit for standalone installations on production hosts.
[0.0.5] - 2026-02-28
Added
- Exploitability-focused advisory guidance, including filtering and prioritization examples.
- Notification examples that include exploitability context and rationale.
Changed
- Clarified exploitability scoring guidance to match runtime values (
high|medium|low|unknown). - Updated response-priority guidance to align with exploitability-first triage.
- De-duplicated exploitability filtering guidance in
SKILL.mdby pointing to canonical docs inwiki/exploitability-scoring.mdandclawsec-suite.