Replace the import-time init() that mutated the DefaultRegistry global with a constructor that returns a ready registry, removing mutate-after-init global state. Exported API unchanged.
Installed golangci-lint v2 rejected the v1 config (unsupported version), silently disabling the lint gate. Migrate to v2 (version, formatters section, linters.exclusions) preserving the same linter selection so the gate runs again.
The chunking Manager had zero production callers (only its own tests). Removed the package and ran go mod tidy, dropping the now-orphaned go-tree-sitter dependency.
When a signature bundle is present, abort the self-update before replacing binaries if cosign verification fails or is unavailable, instead of logging a warning and proceeding. Prevents a malicious/MITM'd release from achieving binary replacement.
Bind 127.0.0.1 instead of all interfaces; wire the previously-unused TokenAuth middleware behind opt-in CLAUDE_MNEMONIC_AUTH_TOKEN (unset = unauthenticated, default-preserving); compare tokens with subtle.ConstantTimeCompare. Also drops the dead contextCache field/type (zero readers).
GoReleaser (.goreleaser.yaml before-hook) and the Makefile regenerate
ui/package.json from ui/package.json.tpl at build time, then run npm ci.
The deps upgrade updated ui/package.json and the lockfile but not the
template, so the release hook regenerated package.json with the old deps
and npm ci failed against the new lockfile. Sync the template to the
upgraded versions (Vite 8, Tailwind 4, vis-network 10, FontAwesome 7,
TypeScript 6, ...). Verified by replaying the hook locally: regenerate
from the template then npm ci + build both pass.
The frontend deps bump regenerated ui/package-lock.json with the
@fortawesome/fontawesome-free tarball resolved from npm.fontawesome.com
(per the developer's scoped ~/.npmrc), which requires auth. CI has no
FontAwesome token, so `npm ci` failed with E401.
The free package is also published to the public registry with an
identical tarball/integrity, so pin @fortawesome to registry.npmjs.org
via ui/.npmrc and repoint the lockfile. Verified `npm ci` + build now
succeed with no token.
lukaszraczylo
github-actions[bot]