Fumanchu
← Back to Changelog

v4.7.3

Release
August 23, 2026

@jaredwray/[email protected] — 2026-08-23

Maintenance release: supply-chain hardening plus runtime and toolchain dependency refreshes.

Documentation

  • add SECURITY.md and DEFENSE_IN_DEPTH.md (7681007, #245)

Internal

  • add CODEOWNERS for high-risk paths (555b373, #246)
  • bootstrap Aikido Safe Chain for cloud agents (4acbc72, #247)
  • set pnpm 7-day dependency cooldown (d5f7d6f, #248)
  • set pnpm trustPolicy to no-downgrade (b39e01a, #249)
  • block pnpm lifecycle scripts by default (896dac5, #250)
  • block exotic pnpm subdependencies (e39403b, #251)
  • install with frozen lockfile in CI (875fbb1, #252)
  • set least-privilege GitHub Actions permissions (330b2bf, #253)
  • pin all GitHub Actions via actions-up (e9e7747, #254)
  • wrap CI installs with Socket Firewall (99e001a, #255)
  • lint GitHub Actions workflows with zizmor (6e07586, #256)
  • disable persist-credentials on checkouts (b12a76d, #257)
  • disable setup-node cache on publish workflows (db0c2fc, #258)
  • stage npm releases instead of publishing live (11fbef9, #259)
  • gate staged npm publish on Aikido scan-release (7f1fd6a, #260)
  • record repository lockdown settings (217ce01, #261)
  • check off lockdown recording after PR #261 (2bb9b1c, #262)
  • record stage-only npm trusted publishing (fa2bc45, #263)
  • upgrade code quality dependencies: @biomejs/biome 2.5.5 → 2.5.8, @faker-js/faker 10.5.0 → 10.6.0, happy-dom 20.11.1 → 20.11.2 (2af0e32, #264)
  • upgrade TypeScript and build tooling: tsx 4.23.1 → 4.23.12, tsdown 0.22.13 → 0.22.14 (e48e66c, #265)
  • upgrade pnpm 11.15.1 → 11.22.0 (9f77323, #266)
  • upgrade tinybench 6.0.2 → 6.1.3 (f6ec449, #267)
  • upgrade dayjs 1.11.21 → 1.11.22 (9faacfe, #268)
  • upgrade markdown-it 14.3.0 → 15.0.0 and drop @types/markdown-it in favor of bundled types (123c5cc, #269)

Contributors

  • @jaredwray (25)

Full List of Changes

  • fumanchu - chore: defense - add SECURITY.md and DEFENSE_IN_DEPTH.md by @jaredwray in #245
  • fumanchu - chore: defense - add CODEOWNERS for high-risk paths by @jaredwray in #246
  • fumanchu - chore: defense - bootstrap Aikido Safe Chain for cloud agents by @jaredwray in #247
  • fumanchu - chore: defense - set pnpm 7-day dependency cooldown by @jaredwray in #248
  • fumanchu - chore: defense - set pnpm trustPolicy to no-downgrade by @jaredwray in #249
  • fumanchu - chore: defense - block pnpm lifecycle scripts by default by @jaredwray in #250
  • fumanchu - chore: defense - block exotic pnpm subdependencies by @jaredwray in #251
  • fumanchu - chore: defense - install with frozen lockfile in CI by @jaredwray in #252
  • fumanchu - chore: defense - set least-privilege GitHub Actions permissions by @jaredwray in #253
  • fumanchu - chore: defense - pin all GitHub Actions via actions-up by @jaredwray in #254
  • fumanchu - chore: defense - wrap CI installs with Socket Firewall by @jaredwray in #255
  • fumanchu - chore: defense - lint GitHub Actions workflows with zizmor by @jaredwray in #256
  • fumanchu - chore: defense - disable persist-credentials on checkouts by @jaredwray in #257
  • fumanchu - chore: defense - disable setup-node cache on publish workflows by @jaredwray in #258
  • fumanchu - chore: defense - stage npm releases instead of publishing live by @jaredwray in #259
  • fumanchu - chore: defense - gate staged npm publish on Aikido scan-release by @jaredwray in #260
  • fumanchu - chore: defense - record repository lockdown settings by @jaredwray in #261
  • fumanchu - chore: defense - check off lockdown recording after PR #261 by @jaredwray in #262
  • chore: defense - record stage-only npm trusted publishing by @jaredwray in #263
  • root - chore: upgrade code quality dependencies by @jaredwray in #264
  • root - chore: upgrade TypeScript and build tooling by @jaredwray in #265
  • root - chore: upgrade pnpm by @jaredwray in #266
  • root - chore: upgrade tinybench by @jaredwray in #267
  • root - chore: upgrade dayjs by @jaredwray in #268
  • root - chore: upgrade markdown-it (breaking) by @jaredwray in #269

Full diff: https://github.com/jaredwray/fumanchu/compare/v4.7.2...v4.7.3