Skip to content

Release 0.2.2: ship claudemux --version #8

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
isingh merged 5 commits into from
Jun 8, 2026
Merged

Release 0.2.2: ship claudemux --version #8

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
944dc3c
chore(release): 0.2.2
isingh Jun 7, 2026
37d63b4
ci: declare least-privilege GITHUB_TOKEN permissions
isingh Jun 7, 2026
0ec5eec
security: build subprocess commands via execFile argv, never a shell …
isingh Jun 8, 2026
1001fc2
security(deps): upgrade vitest 2 -> 4 to clear dev-dependency advisories
isingh Jun 8, 2026
53a15c1
docs(changelog): note the 0.2.2 dev/CI security hardening
isingh Jun 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,12 @@

name: ci

# Least privilege for GITHUB_TOKEN: both jobs only check out and run build/test
# — neither writes to the repo, comments, or publishes. A top-level block applies
# to every job and sets all unlisted scopes to `none` (CodeQL: missing-permissions).
permissions:
contents: read

on:
push:
branches: [main, "init/**"]
Expand Down
21 changes: 21 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,26 @@ All notable changes to this project will be documented in this file.
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

## [0.2.2] - 2026-06-07

### Added

- **`claudemux --version`** prints the package version (read from `package.json`).
Previously rejected as an unknown option. Thanks to an external contributor.

### Security

- **No consumer-facing vulnerabilities** — the items below are dev/CI hardening
only; the published package ships `dist/` + `bin/` (no `node_modules`), so none
of these ever reached installs of `@wastedcode/claudemux`.
- Upgraded **vitest 2 → 4** to clear three dev-dependency advisories (vitest UI
arbitrary-file read/exec — the UI server is never run here; transitive vite
`.map` path traversal; esbuild dev-server). `npm audit` is now clean.
- Hardened subprocess calls in the test/dev scripts to build argv arrays via
`execFile` instead of interpolating values (incl. `CLAUDEMUX_SOCKET`) into a
shell string. Shipped `src/` was already shell-free.
- CI workflow now declares least-privilege `permissions: contents: read`.

## [0.2.1] - 2026-06-07

### Fixed
Expand Down Expand Up @@ -279,6 +299,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
- Windows-native is not supported. tmux is Unix-only; WSL is
community-contributable, undocumented by the maintainers.

[0.2.2]: https://github.com/wastedcode/claudemux/compare/v0.2.1...v0.2.2
[0.2.1]: https://github.com/wastedcode/claudemux/compare/v0.2.0...v0.2.1
[0.2.0]: https://github.com/wastedcode/claudemux/compare/v0.1.0...v0.2.0
[0.1.0]: https://github.com/wastedcode/claudemux/compare/v0.0.1...v0.1.0
Expand Down
Loading
Loading