Skip to content

Release @logicsrc/openprd 0.2.0 to npm - #145

Open
ralyodio wants to merge 1 commit into
masterfrom
openprd-npm-release
Open

Release @logicsrc/openprd 0.2.0 to npm#145
ralyodio wants to merge 1 commit into
masterfrom
openprd-npm-release

Conversation

@ralyodio

@ralyodio ralyodio commented Sep 7, 2026

Copy link
Copy Markdown
Contributor

@logicsrc/openprd@0.2.0 is published to npm. This PR syncs master to what the registry now has.

The first release of this package, and the first carrying OpenPRD 0.3 (Tech Stack + Monetization, #144).

Why the manifest had to change

  • @logicsrc/validators was file:../validators. npm publishes that spec verbatim, so any install outside this monorepo would have failed to resolve the dependency — the package would have been on the registry and uninstallable. Now ^0.1.0, which matches what's published. npm workspaces still links the local package for development, since 0.1.0 satisfies the range.
  • Added a README. Without one the npm page reads "No README data found", a poor landing surface for the reference implementation of a public standard. @logicsrc/schemas already ships one; @logicsrc/validators does not, and shows exactly that.

Verification

Installed 0.2.0 from the registry into an empty project:

└─┬ @logicsrc/openprd@0.2.0
  ├─┬ @logicsrc/validators@0.1.0
  │ ├── @logicsrc/schemas@0.1.0
OPENPRD_VERSION = 0.3
sections = 10  ["Problem","Goals","Non-Goals","Users","Requirements","UX Notes","Tech Stack","Monetization","Success Metrics","Risks & Open Questions"]
0.2 sections = 8

packages/openprd tests: 79 passed against the bumped manifest. package-lock.json is unchanged — the workspace link resolves identically under the semver range.

🤖 Generated with Claude Code

https://claude.ai/code/session_017XRNNm6pK6nPi7rJ6bJNHu

Published as @logicsrc/openprd@0.2.0 — the first release of this package, and
the first carrying OpenPRD 0.3 (Tech Stack and Monetization, #144).

Two things had to change for the publish to be usable:

  - The @logicsrc/validators dependency was `file:../validators`. npm publishes
    that spec verbatim, so every install outside this monorepo would have
    failed to resolve it. It is now `^0.1.0`, which is what is on the registry;
    npm workspaces still links the local package for development, since 0.1.0
    satisfies the range.
  - Added a README. Without one the npm page reads "No README data found",
    which is a poor landing surface for the reference implementation of a
    public standard. @logicsrc/schemas already ships one.

Verified by installing 0.2.0 from the registry into an empty project: it
resolves @logicsrc/validators@0.1.0 and @logicsrc/schemas@0.1.0, and the
runtime reports OPENPRD_VERSION 0.3 with ten sections, eight for 0.2.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017XRNNm6pK6nPi7rJ6bJNHu
@github-actions

github-actions Bot commented Sep 7, 2026

Copy link
Copy Markdown

ThreatCrush Security Scan

21 finding(s)

HIGH/CRITICAL: 3 | MEDIUM: 9 | LOW: 9

Severity Rule Location
HIGH secret-private-key plugins/credential-sharing/src/providers/ssh.ts:129
HIGH js-host-header-trust apps/commandboard-web/server.js:27
HIGH js-ssrf-outbound-request apps/pwa/public/sw.js:45
MEDIUM js-unescaped-html-sink apps/commandboard-web/src/main.ts:19
MEDIUM js-unescaped-html-sink apps/logicsrc-web/src/app/[[...slug]]/page.tsx:73
MEDIUM js-unescaped-html-sink apps/logicsrc-web/src/app/layout.tsx:83
MEDIUM js-unescaped-html-sink apps/logicsrc-web/src/app/pricing/page.tsx:46
MEDIUM js-unescaped-html-sink apps/logicsrc-web/src/components/site-shell.tsx:49
MEDIUM redos-nested-quantifier packages/opencontext/src/ids.ts:10
MEDIUM redos-nested-quantifier packages/opencontext/src/ids.ts:11
MEDIUM js-timing-unsafe-mac-compare packages/opencontext/src/validate.ts:208
MEDIUM redos-nested-quantifier packages/openontology/src/ids.ts:20
LOW secret-generic-credential apps/pwa/test/appbar.test.mjs:10
LOW secret-aws-access-key packages/opencontext/src/permissions.test.ts:260
LOW secret-private-key packages/opencontext/src/permissions.test.ts:261
LOW secret-stripe-key packages/opencontext/src/permissions.test.ts:262
LOW secret-aws-access-key packages/opencontext/src/security.test.ts:228
LOW secret-private-key plugins/credential-sharing/src/providers/ssh.test.ts:7
LOW secret-database-url plugins/credential-sharing/src/rekey.test.ts:33
LOW secret-openai-key plugins/credential-sharing/src/vault-encryption.test.ts:21
LOW secret-generic-credential plugins/credential-sharing/src/vault-encryption.test.ts:21

Snippets are redacted; ThreatCrush never prints matched credential material.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant