Release v0.2.4

Author: jvm

CHANGELOG.md

@@ -4,7 +4,31 @@ All notable changes to this project will be documented in this file.
 
 This project aims to follow [Semantic Versioning](https://semver.org/). Breaking changes include incompatible changes to command names, required arguments, JSON output contracts, structured error envelopes, stable exit codes, or safety behavior such as `--force` requirements.
 
-## [Unreleased]
+## [0.2.4] - 2026-06-15
+
+### Security
+
+- Closed a prototype-pollution gap: profile names matching reserved `Object.prototype` keys (`__proto__`, `prototype`, `constructor`) are now rejected by `safeProfileName` with the `invalid_profile` error code and `Usage` exit code.
+- Routed all dynamic-key reads, writes, and deletes on the credentials, profiles, and config maps through centralized wrappers (`src/core/profiles-map.ts`, `src/core/safe-io.ts`) so user-controlled keys can no longer reach the prototype chain.
+- Replaced the regex-based principal parser in `assertWindowsOwnerOnly` with a linear scan (`extractIcaclsPrincipal`) and swapped the `:(` anchor check for `indexOf(":(")` to drop a `safe-regex` complexity warning.
+- Force-patched `esbuild` to `>=0.28.1` via `pnpm-workspace.yaml` `overrides` to close the open Deno RCE and Windows dev-server file-read advisories across all transitive consumers (`vitest`, `tsx`, etc.).
+- Moved the build-script allowlist from `package.json`'s `pnpm.onlyBuiltDependencies` to `pnpm-workspace.yaml`'s `allowBuilds` (with `strictDepBuilds: false`); `esbuild` and `lefthook` are still allowed to run install-time build scripts, but the list is now explicit at the workspace level rather than per-package.
+- New `.github/workflows/security.yml` (reusable workflow, also called by `release.yml`): `npm audit --omit=dev --audit-level=high` on production deps; `betterleaks` 1.5.0 (SARIF uploaded to Code Scanning) on every push to `main`, on PRs that touch `src/**`, `package.json`, `pnpm-lock.yaml`, or `.github/workflows/**`, and on a weekly schedule; `shellcheck` on `*.sh`; and `actionlint` + `zizmor` (high severity, medium confidence) on `.github/workflows/`. Replaces the old `gitleaks` step in `ci.yml`.
+- New `.github/workflows/codeql.yml`: CodeQL JavaScript/TypeScript analysis on push to `main`, on PRs to `main`, and weekly.
+- `ci.yml` now runs `pnpm audit --audit-level=high` (was `--audit-level moderate`) after build, on a Node 24 / 26 matrix.
+
+### Changed
+
+- Bumped the supported Node.js runtime from `>=20.11` to `>=24`. Older Node versions are no longer supported; upgrade to Node 24+ before updating.
+- Replaced the `tsup` build pipeline with `tsc` (NodeNext ESM). The published `dist/` layout and the `raindrop` binary entry point are unchanged.
+- Stack: pnpm 11.6, TypeScript 6, ESLint 10, Vitest 4, Prettier 3.8, `lefthook`, plus `eslint-plugin-security`, `safe-regex`, and `betterleaks` in the dev toolchain. A new `pnpm validate` runs lint + format:check + typecheck + test + build + audit end-to-end.
+- Runtime dependencies: `commander` 14 → 15, `smol-toml` 1.4 → 1.6, `zod` 4.1 → 4.4. No public CLI contract changes.
+
+### Internal
+
+- Extracted the OAuth login completion flow into a `completeOAuthLogin` helper in `src/cli.ts`.
+- Shared the `commands.yaml` parser between `codegen` and `spec-lint` via a new `scripts/lib/parse-commands-yaml.ts`.
+- Added a `runCli` test helper and a `globalSetup` that isolates `RAINDROP_CONFIG_DIR` per test file.
 
 ## [0.2.3] - 2026-05-10
 

docs/commands.md

@@ -2,7 +2,7 @@
 
 <!-- AUTO-GENERATED by scripts/codegen.ts — do not edit by hand -->
 
-Generated from spec/commands.yaml on 2026-06-14.
+Generated from spec/commands.yaml on 2026-06-15.
 
 Command names below use the actual shell syntax. The source command IDs in `spec/commands.yaml` use dots, for example `bookmark.add` maps to `raindrop bookmark add`.
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mocito/raindrop-cli",
-  "version": "0.2.3",
+  "version": "0.2.4",
   "description": "Agent-friendly CLI for Raindrop.io",
   "type": "module",
   "repository": {