# Changelog

All notable changes to this project are documented here. The format is
[Keep a Changelog](https://keepachangelog.com/en/2.0.0/) 2.0.0, and this project adheres to
[Semantic Versioning](https://semver.org/spec/v2.0.0.html).

## [Unreleased]

## [1.2.0] - 2026-10-27

### Added

- Wiki page `06-Ecosystem-Matrix`: the exposure rule, risk per data path, vulnerable and fixed versions
  per component (Node.js, Bun, Python, .NET, Envoy, Istio), the distribution table with advisories,
  and an explicit map of what this repository does not cover.
- Wiki page `07-Inventory`: package, runtime, container, static-copy and code-path commands, the live
  `/proc` scan, the exposure classes and the fields every inventory row must carry.
- Wiki page `08-Remediation-Playbooks`: five principles, P0–P3 priority, procedures per runtime, and
  the closure evidence a finished row needs.
- Wiki page `09-Interim-Mitigations`: `415` at the edge, framework defaults for request
  decompression, outbound decode restrictions, workload isolation, detection signals and
  post-mitigation validation.

### Changed

- Wiki page `05-Advisory-Digest` rewritten around the incident record: the GHSA identifier, the three
  public aliases, root cause in one paragraph, the disclosure timeline, the two severity scales, what
  the record does not settle, and sources with their evidence level.
- Wiki pages renamed for a continuous sequence: `06-Operations` → `10-Operations`, `07-Traps` →
  `11-Traps`; the operating runbook gained a verification checklist and the trap register gained four
  rows (end-of-life runtimes, default request decompression, control plane versus data plane).
- `SUPPORT.md` and the issue-template link follow the rename. The wiki navigation is regrouped into
  Start, The audit, The record, Do the work, Operate.

## [1.1.0] - 2026-10-27

### Added

- `wiki/` — seven operator pages: why a version check is not an audit, deployment, the repository
  contract, field cases, the advisory digest, the operating runbook and the trap register.
- Field cases page: the three hosts, the nine defects the first run exposed, the measurement that
  found each one and the fix that encoded it.
- Advisory digest page: affected and fixed releases per ecosystem, distribution packages measured on
  the audited hosts, the CVSS 4.0 and 3.x scores with their scales, the public aliases of the flaw
  and the sources, each with its evidence level.
- Six-language documentation set: English canonical files plus `.de.md`, `.es.md`, `.hi.md`,
  `.ru.md`, `.zh.md` translations of every document.
- Repository hygiene: `CHANGELOG.md`, `CONTRIBUTING.md`, `SECURITY.md`, `CODE_OF_CONDUCT.md`,
  `SUPPORT.md`, `CITATION.cff`, `.editorconfig`, `.gitattributes`, issue forms, pull request
  template, `CODEOWNERS`, `dependabot.yml` and a CI workflow that runs `shellcheck`, `bash -n` and
  the encoding checks.

### Changed

- English is the canonical documentation language; the Russian originals moved to `.ru.md`.
- `README.md` rewritten around the four questions an audit owes, the verdict contract and the
  limitations, with badges and a documentation table.
- `docs/FIELD-REPORT.md` rewritten from a defect list into an evidence record: what was visible, what
  the cause was, and how the cause was found.

### Fixed

- `src/detect.sh` and `src/remediate.sh` no longer rely on `A && B || true` as a conditional: the
  classification and the backup copy are written as explicit `if` blocks, so the intent does not
  depend on the ShellCheck release that reads it.
- CI pins ShellCheck 0.11.0 by downloading the release binary: the distribution package still ships
  0.9, and the two releases disagree on `SC2015` — a gate whose verdict depends on the runner image
  is not a gate.
- CI now also runs on version tags: the release job compared the tag with `CITATION.cff`, but the
  workflow only listened to branch pushes, so that job had never executed.
- The identifier check compares every translation with its canonical file instead of demanding all
  identifiers in every document, which is what it was meant to do.
- `src/common.sh` and `src/remediate.sh` pass ShellCheck 0.11 with no findings: an unused local
  removed from the consumer loop, the changelog check written as an explicit `if`/`else`, and the two
  intentional word-splittings and the fixed `ls` pattern declared inline with their reasons.
  `.shellcheckrc` records why `SC1091` stays off: `common.sh` is sourced through a runtime path.
- The field report described one defect with a templated unit name that a privacy linter reads as
  an e-mail address; the wording now names the concrete unit instances instead.

## [1.0.0] - 2026-10-27

### Added

- `src/detect.sh` — read-only audit: verdict `SAFE`/`VULNERABLE`/`NOT_INSTALLED`, JSON report and a
  before-state snapshot.
- `src/remediate.sh` — backup, authenticity gate on the packaged changelog, dry run, installation,
  restart of server consumers, stale-inode check.
- `src/verify.sh` — version change, CVE reference, stale mappings, failed units, decode round-trip.
- `src/common.sh` — logging, Debian version parsing, the vulnerable release matrix, key-based state
  reading, the desktop and infrastructure denylist.
- `SKILL.md` — the minimal orchestration playbook for an agent runtime; three commands, one line of
  output each.
- `AGENTS.md`, `docs/THREAT-MODEL.md`, `docs/PLAYBOOK.md`, `docs/FIELD-REPORT.md`.

### Security

- No credentials, tokens, host addresses or hostnames in the repository; hosts are passed as SSH
  aliases.
- The authenticity gate refuses a candidate whose packaged changelog does not name the CVE.

[Unreleased]: https://github.com/paulmann/CVE-2026-111497/compare/v1.2.0...HEAD
[1.2.0]: https://github.com/paulmann/CVE-2026-111497/compare/v1.1.0...v1.2.0
[1.1.0]: https://github.com/paulmann/CVE-2026-111497/compare/v1.0.0...v1.1.0
[1.0.0]: https://github.com/paulmann/CVE-2026-111497/releases/tag/v1.0.0