All notable changes to @sentinel-scan/core and @sentinel-scan/cli are documented here.
The format is based on Keep a Changelog.
- Default exclusion of common vendor/minified file patterns (
**/*.min.js,**/*.min.mjs,**/vendor/**,**/vendors/**,**/third-party/**,**/third_party/**,**/bower_components/**)
- User-provided
excludepatterns now merge with engine defaults instead of replacing them wholesale — previously, setting a custom exclude silently droppedbuild,*.d.ts, and test-file exclusions
sentinel initscaffolded config generates its exclude array dynamically fromDEFAULT_SCAN_CONFIGat generation time, instead of a hardcoded list that could drift out of syncincludecontinues to replace engine defaults when provided (unchanged behavior — allows narrowing scan scope)
- Fixed a crash in
hasCatchChain's AST parent-walk (double-increment bug) that caused real-world API files usingawait fetch(...)inside async functions to fail parsing entirely scan()parse-error diagnostics now include the underlying error message instead of repeating the filename
- Initial public release: scan pipeline,
no-hardcoded-urlandmissing-error-handlerrules, OpenAPI v3 contract-mismatch detection (request body only), CLI withinit/scancommands