codetruss 0.2.46

[DeliriumPulse]

Bumps the formula to v0.2.46.

url    https://github.com/CodeTruss/codetruss-cli/releases/download/v0.2.46/codetruss-cli-0.2.46.tgz
sha256 047dc9915d8c0594c913d1c29813edeecb7c71b0fd4e594ab0221139955ad643

The digest was derived by downloading that exact URL and hashing it locally, then cmpd against the archive the website serves — not copied from the release notes. The same cmp against 0.2.45 exits 1, so the comparison is capable of failing. gh attestation verify on the downloaded archive exits 0; flipping one byte of it makes the same command exit 1.

0.2.46 bounds brace expansion in scope globs. --allow and --deny are matched with minimatch, which expands brace groups through brace-expansion, and the bundled copy was 5.0.7 — a version that caps the number of expansions but not their length. allow and deny are read from the scanned repository's .codetruss.yml, so the pattern does not have to come from whoever ran the command. Reproduced against the shipped bundles on two fresh fixtures with a byte-identical 7.5 KB glob: 0.2.45 aborts with an uncatchable out-of-memory at 4.07 GB and writes no receipt, 0.2.46 returns REVIEW_REQUIRED and writes one. brew install users on 0.2.45 have a review that a repository can kill instead of failing.

Nothing is disclosed or altered by this and no verdict changes — the worst case was a local tool dying instead of reporting. brace-expansion moves 5.0.7 → 5.0.9 and minimatch 10.2.5 → 10.2.6; scope matching is unchanged across 1938 compared (path, pattern) pairs.

🤖 Generated with Claude Code