# v0.1.8 — Dependency Security Fixes for DSH rc.2

[简体中文](./v0.1.8.zh-CN.md)

Version `0.1.8` repairs the dependency findings recorded for TUI `0.1.7`: **14 affected production package entries, including 6 high and 8 moderate**, from five advisories. It retains DeepSeek Harness `0.2.0-rc.2`, its source files, the Claude Code `2.1.227` interaction target, and the existing Node.js support contract.

## Changes

- Updates Sharp `0.35.3` → `0.35.5`, MCP client/core `2.0.0` → `2.2.0`, fast-uri `3.1.7` → `3.1.8`, and the fflate consumed by libreoffice-kit `0.8.2` → `0.8.3`.
- Repairs the exact MCP and fflate pins using reproducible dependency archives that change only the owning packages' `package.json` dependency declarations. Package names, versions, upstream source bytes, file modes, and licenses are preserved. These archives are maintained by this project; they are not new upstream releases.
- Pins the two public HTTPS archives to the full Git commit containing them, with integrity recorded in both locks and the [provenance record](https://github.com/cogine-ai/dsh-claude-tui/blob/0e0e57954e3502234fbd8a835b6fdaff235de3ad/vendor/security/provenance.json). A merge commit preserves that archive commit's ancestry and dependency provenance. Ordinary npm consumers need no override or installation-time patch; first installation also requires access to GitHub raw content.
- Converges compatible workspace, optional, and development dependencies on patched releases. Retains the workspace's optional GenAI MCP bridge with SDK v1 `1.31.0` and adds a local stdio regression; the published production graph continues to omit SDK v1.
- Adds actual dependency-owner regressions for native PNG/SVG conversion, Office ZIP round trips and bounded malformed ZIP64 rejection, AJV URI normalization, and the DSH MCP stdio/HTTP bridge. Existing CLI, PTC, Session, migration, and terminal checks remain required.

## Install

Select this version explicitly:

```bash
npx --yes dsh-claude-tui@0.1.8
```

For a persistent command:

```bash
npm install --global dsh-claude-tui@0.1.8
dshtui
```

Requires Node.js **22.19+ in 22.x, or 24.2+** (`^22.19.0 || >=24.2.0`). The `dshtui` and `dsh-claude-tui` commands use the same launcher. DSH remains `0.2.0-rc.2`; external runtimes still require `>=0.2.0-rc.2 <0.2.1` and an isolated behavioral probe. External DSH installations have their own dependency graph; these repairs target the bundled graph.

## Upgrade and qualification

This update keeps the DSH V4 Session format and existing managed-Home behavior. Supported predecessor migrations retain the old files' bytes. Continue to use isolated Homes for cross-version testing and avoid concurrent runtimes sharing one Home.

Checks recorded on 2026-10-11 at security candidate [4d604c9](https://github.com/cogine-ai/dsh-claude-tui/commit/4d604c9), before the `0.1.8` version bump:

- Full workspace audit: **0 advisories**, including the retained optional SDK v1 branch, across 807 dependency entries.
- macOS arm64, Node `24.16.0`, complete check: **184 passed / 1 skipped** across 16 files, with typecheck, build, and all 1,803 official DSH documentation files verified.
- Node `22.23.3`, npm `10.9.9`, fresh ordinary npm installation with a new cache and no consumer override: **production audit 0**; all 278 installed DSH packages remain `0.2.0-rc.2`. The ordinary npm bundle gate passed **14 tests / 1 skipped**. The actual native libraries were heif `1.23.5`, rsvg `2.63.2`, and vips `8.18.7`.
- Both dependency archives and their provenance regenerate byte-for-byte; anonymous HTTPS downloads match the committed archives. `npm ls --all` succeeds, with only the existing, narrowly allowed optional Sharp residue.

The `0.1.8` version candidate also passed the complete Node `24.16.0` gate: **16 files / 184 passed / 1 skipped**, frozen installation, workspace audit **0**, and byte-for-byte archive reproduction. Final ordinary-install validation, exact merged-commit publication, and registry readback are recorded on [PR #23](https://github.com/cogine-ai/dsh-claude-tui/pull/23) and the GitHub Release. Ubuntu CI targets Node `22.19.0`, `22.22.3`, `24.2.0`, and `24.14.0`.

Installed-artifact checks use local Messages/Files and MCP servers. They do not establish production-provider behavior or custom OAuth plugin qualification. The opt-in real system-clipboard check was skipped; Windows packed-TUI/ConPTY remains unqualified. ZIP parser coverage does not qualify native LibreOffice conversion on every platform. Audit results describe the advisory data available on the validation date.

See the [dependency security record](../dependency-security-rc.2.md), [DSH adaptation record](../harness-0.2.0-rc.2-adaptation.md), and [launcher rules](../launcher-environment-compatibility.md).