EmryZhang opened a new pull request, #575: URL: https://github.com/apache/casbin-node-casbin/pull/575
This prepares the next Node-Casbin source release under the npm name `apache-casbin`. It updates the committed version and package identity, legal files, dependency lock and publication workflow together, and incorporates the fixes merged since 5.51.1. Domain-pattern inference now requires positive mandatory matcher conditions tied to the actual role function and domain argument. Quoted text, optional branches and resource-path matching preserve exact-domain role isolation. Eleven regressions cover those cases and retain normal pattern matching and explicitly registered domain functions. The release workflow keeps RCs out of npm, checks approved ASF originals before final packaging, and refuses asset replacement. Conformance fixtures are pinned to one revision; CI, coverage and final-package testing use the same inputs and disable install scripts. The new conformance test's original copyright sentence is retained in NOTICE. Validation on Windows: - Node 20.20.2 and 22.23.4: 251 tests each, zero skips; includes 33 conformance cases with 5,282 requests. - Actual local source archive: extracted tests/build pass; 155-file RAT inventory reconciled, zero unapproved findings; three JSON-config detection blind spots separately scanned with identical bytes. - Actual npm package: 161 files, metadata/legal/content verification; installed CommonJS and native ESM checks, strict TypeScript and permission save/reload tests pass. - Frozen dependency install, 934 dependency license/notice sets reconciled, 18 release-helper safety fixtures, actionlint, metadata checks and Gitleaks pass. Dependency review retains one moderate minimatch advisory match: it requires `optimizationLevel >= 2`; the library calls minimatch without options and the installed version defaults to level 1. Development-tool advisory paths are assessed separately. The review does not claim an advisory-free dependency graph. The archives used for these checks are unsigned local preparation inputs. After project review and merge, the actual merged commit, hosted CI and workflow candidate need verification before signing/staging and the applicable votes. Registry administration and final publication remain later release steps. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
