v1.3.0

Highlights

🐛 Bug Fix: Commands in complex shell constructs now properly extracted

Previously, commands hidden in certain shell constructs would bypass permission checking:

# These commands were NOT being extracted (security gap):
arr=($(dangerous_cmd))                    # Array initialization
echo ${var:-$(dangerous_cmd)}             # Parameter expansion defaults
mapfile -t lines < <(dangerous_cmd)       # Process substitution in redirects
count=$(find /path | wc -l | tr -d ' ')   # Variable assignment (fixed in v1.2.0)

All of these are now properly extracted and checked against your permissions.

---

What's Changed

🔧 Maintenance

• ci: upgrade actions/checkout to v6 and remove redundant fetch-depth by @AbdelrahmanHafez in #11
• chore: add dependabot for monthly dependency updates by @AbdelrahmanHafez in #12
• chore(deps): bump actions/setup-node from 4 to 6 by @dependabot in #13
• chore(deps): bump @stylistic/eslint-plugin from 2.13.0 to 5.6.1 by @dependabot in #15
• chore(deps): bump @types/node from 20.19.26 to 25.0.0 by @dependabot in #14

New Contributors

• @dependabot made their first contribution in #13

Full Changelog: v1.2.0...v1.3.0