The v0.1.1 release of docmd-search focuses on security hardening, sanitisation of dynamic file path generation, and secure execution of child processes.

What’s in This Release

Security Hardening

• Secure Child Process Spawning (CWE-78 mitigation):
  • Replaced shell-based exec calls with direct, non-shell execution using execFile and execFileAsync via argument arrays when checking git status --porcelain.
  • Replaced shell-based execSync with execFileSync when discovering the global docmd CLI path, ensuring no shell expansion is performed.
• Dynamic Config Path Sanitisation (CWE-94 mitigation):
  • Sanitised directory paths interpolated into the generated web UI configuration (docmd.config.json) using JSON.stringify to prevent breakout vulnerability vectors.
• Dynamic Code Evaluation Remediation (CWE-95 mitigation):
  • Removed the new Function('id', 'return import(id)') constructor previously used to import optional peer dependencies dynamically, replacing it with standard ECMA dynamic import() coupled with build-time annotations.
• Deprecation & Warning Clearance:
  • Configured package.json overrides to force onnxruntime-node@1.27.0, resolving the transitive boolean package deprecation warnings.
  • Configured allowScripts in package.json to whitelist required lifecycle binaries (esbuild, onnxruntime-node, protobufjs, sharp) to suppress warnings during installation.

Performance Optimisations

• Model Caching: Added a new keepModelLoaded option to keep the embedding model loaded in memory, eliminating the model-load overhead on subsequent watch/rebuild runs.

Compatibility