docs(changelog): correct the v0.5.0 entries the post-audit commits invalidated - #430
Merged
Merged
Conversation
…validated Five commits landed on release/v0.5.0 after the section was written. Two changed what ships: #429 was undocumented — it widens the default ignored-files globs, which is a behavior change for existing deployments: a repo keeping handwritten source under build/, bin/, out/ or vendor/ silently stops having it reviewed. Added under Changed with that caveat called out. #423 audited the branch and altered behavior three existing entries describe: the #97 arithmetic cap became evidence-dependent rather than absolute, #324 gained collaborator and repo-scope gating plus INFO-log redaction, and #123's detector grew past its Java-shaped origins to JS/TS literals, arrow validators, package-private declarations, and multiline construction. Per the release convention, #423's own fixes get no Fixed entries — they repair code introduced in this cycle, which never reached a user. They are folded into the feature entries instead, because those describe what actually ships. Fixed still holds only pre-0.5.0 behavior: #107, #334, #336, #337. Prose kept to the existing house voice: bold marks the entry name only, never mid-sentence emphasis, matching every prior release section. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Contributor
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
🤖 ThrillhouseBot PR SummaryWhat this PR doesThis PR corrects the v0.5.0 changelog entries that were invalidated by commits landing after the section was originally written. It adds a previously missing feature entry for wider default ignored-files patterns (#52), updates three existing entries (#324, #123, #97) to reflect the actual shipped behavior, and adds a Dependencies line about the Node 22 requirement and pinned PostCSS/Sharp versions. Changes Overview
Changed Files
Risk Assessment
No new issues found in this PR, but the review cannot be approved until CI is confirmed green.
|
| Check | Type | Status | Detail |
|---|---|---|---|
| actionlint | check-run | ⏳ Pending | - |
| frontend | check-run | ⏳ Pending | - |
| changes | check-run | ⏳ Pending | - |
| format | check-run | ⏳ Pending | - |
| test | check-run | ⏳ Pending | - |
| dependency-review | check-run | ⏳ Pending | - |
Automated review by ThrillhouseBot. Reply with /review to re-run.
thrillhousebot
Bot
added
the
documentation
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What type of PR is this?
Description
Five commits landed on
release/v0.5.0after the[0.5.0]section was written. Two of them changedwhat actually ships, leaving one feature undocumented and three entries describing behaviour that no
longer exists.
#429 was missing, and it changes existing deployments
It widens the default
thrillhousebot.review.ignored-filesglobs (closes #52) to coverpnpm-lock.yaml,go.sum, protobuf output, minified bundles and sourcemaps, and the directoriesnode_modules/,dist/,build/,out/,.next/,vendor/,__pycache__/,.venv/,bin/,obj/.Filed under Changed rather than Added, because it is not additive for anyone already running the
bot: the directory globs match by name, so a repository keeping handwritten source under
build/,bin/,out/orvendor/silently stops having it reviewed on upgrade. The entry says so — thecode's own javadoc carries the same warning.
#423 invalidated three entries
The audit commit touched 35 files (+2303/−159) and never touched the changelog:
GET /api/dashboard/feedbackto repos the caller can access, bounds capture concurrency, and no longer logs source-line contents at INFOfunction/arrow validators, package-private Java declarations, and multiline construction over a bounded window — and only confirms a synthesized failure when the expected domain or contract is visibleAlso added a Dependencies line for the Node 22 requirement and the PostCSS/Sharp pins, which is what
makes a clean
npm ciresolve without known high-severity advisories.Related Issues
N/A — release documentation accuracy.
How Has This Been Tested?
Verified against the branch state:
Fixedaudited entry by entry for pre-0.5.0 scopeProse checked against the house voice rather than written free-hand: bold marks the entry name and
nothing else, matching every prior release section (0.4.0 and 0.3.x use no mid-sentence bold at all).
Em dash density lands at 11.1 per 1000 words against 12.9 in 0.3.1 and 13.3 in 0.3.0, so it reads
consistently with the sections around it.
Checklist