# Jiva v0.3.22 - Security Updates & CI Automation

**Release Date:** February 25, 2026  
**Type:** Maintenance Release

## Overview

Security maintenance release upgrading deprecated transitive dependencies and adding automated npm publishing via GitHub Actions.

## Changes

### Security & Dependency Updates

- Upgraded `glob` from `10.5.0` (deprecated) to `^13.0.0` (current) via npm `overrides` — resolves the widely-publicised security vulnerabilities in old glob versions
- Upgraded `tr46` from `0.0.3` to `^3.0.0` via npm `overrides` — eliminates the `[DEP0040] DeprecationWarning: The punycode module is deprecated` Node.js warning by switching from the built-in `punycode` module to its maintained userland equivalent
- Ran `npm audit fix` to resolve all remaining moderate/high severity vulnerabilities (minimatch ReDoS, `@isaacs/brace-expansion`, MCP SDK issues)

### CI/CD

- Added `.github/workflows/npm-publish.yml`: a GitHub Actions workflow that automatically builds and publishes the package to npm whenever a new GitHub Release is published.

## Upgrade Instructions

```bash
npm install -g jiva-core@0.3.22
```

## Required GitHub Secrets

To enable automatic npm publishing, configure the following secret in the repository's **Settings → Secrets and variables → Actions**:

| Secret | Description |
|--------|-------------|
| `NPM_TOKEN` | An npm Automation or Publish token for the `jiva-core` package. Generate one at [npmjs.com → Access Tokens](https://www.npmjs.com/settings/~/tokens) and choose **Automation** type. |

The workflow triggers on every published GitHub Release (`on: release: types: [published]`).
