Changelog

Release history for the Bazable CLI, following Keep a Changelog and Semantic Versioning.

All notable changes to Bazable are documented here. The format is based on Keep a Changelog and this project adheres to Semantic Versioning.

Unreleased

Planned

• bazable doctor diagnostic command.
• bazable env for environment management.

1.3.5 — 2026-08-29

Added

• Newman / Postman integration:
  • bazable export --postman to generate a Postman Collection v2.1.
  • bazable test --newman to run tests through Newman.
  • bazable ci --newman to include a Newman step in the generated GitHub Actions workflow.
  • bazable serve --verify to automatically run Newman against the mock server.
  • bazable gen backend --postman to generate a Postman collection alongside backend stubs.
  • --reporter and --env-var options for Newman in bazable test.
• New internal utilities: src/utils/postman.js, src/utils/newmanRunner.js, src/utils/security.js, src/utils/spawnSafe.js.
• Added postman-collection as a dependency.

Changed

• export now supports both OpenAPI and Postman formats (OpenAPI remains the default).
• test supports optional Newman execution (additive, backward compatible).
• serve supports an optional --verify flag (default off).
• gen backend supports optional --postman and --test flags.
• All child processes now use safe spawn (no shell) via spawnSafe.js.

1.3.4

Added

• Trusted publishing support: publishConfig.provenance and publishConfig.access in package.json.
• npm run security script for local audit.
• engines and files fields to reduce package surface.
• SECURITY.md for vulnerability reporting policy.

Changed

• watch now uses the Bazable Cloud API (/projects/:id/contracts/latest) instead of Supabase, reusing the cloud token.
• watch: auto-fix (inspect --fix) is now opt‑in via the --auto-fix flag.
• Replaced execSync in watch with safe spawn (child_process.spawn without a shell).
• Updated .github/workflows/publish.yml to use OIDC trusted publishing (no NPM_TOKEN).

Fixed

• Replaced cubrin.com email in the mock server with example.com to avoid scanner flags.
• Added URL validation (SSRF protection) in watch for remote URLs and WebSocket URLs.
• Added WebSocket message validation and rate limiting to prevent abuse.

Removed

• postinstall script removed to eliminate install-time code execution risk.

1.3.3

Added

• bazable review to show provenance and inference confidence.
• Provenance tracking: each extracted API URL now records file, line, and column.
• Field-level inference metadata (confidence, source_value, source_type) stored in request_meta.

Changed

• extract now stores provenance and request_meta in bazable.config.json.
• inferRequestSchemasFromFile resolves variables across script blocks in the same file.

Fixed

• Accurate line numbers in HTML script blocks for provenance.

1.3.2

Security

• ReDoS protections for glob/regex inputs (isSafeGlobPattern, isSafeRegex).
• SSRF protections for URLs (isUrlAllowed).
• Path traversal prevention via safeJoin.
• Redaction helper for secrets in logs.

1.3.0

Added

• bazable lsp (Language Server Protocol).
• bazable mcp (Model Context Protocol server).
• bazable curl (raw HTTP request with logging, CORS bypass).
• gen context subcommand for AI agent context files.
• gen db subcommand for Prisma / Supabase SQL.
• WebSocket real-time sync in watch.
• CSV seed support for serve.

Changed

• Cloud sync (push, sync, watch) now uses device-code OAuth and WebSocket.
• bazable --version reads from package.json.

1.2.0

Added

• explain, propose, and accept for AI-assisted contract negotiation.
• review (early version).
• export to produce an OpenAPI spec.
• hook to install a pre-push Git hook.
• ci to generate a GitHub Actions workflow.
• ui for the local dashboard.
• docs to generate static API documentation.
• import for OpenAPI / Swagger / Postman / CSV.
• test with mock mode and auto-login.
• types and client generation.

Changed

• Extraction engine improved with presets, template literals, and multi-base URL support.
• serve now supports CSV seeding.

1.1.0

Added

• Basic contract management: init, add, extract, inspect, config, login, errors.
• diff to compare the stored schema with a live API.
• errors to view and clear the persistent error log.

1.0.0

Added

• Initial release: init, add, extract, inspect, test, diff, types, client, gen backend, gen ui, serve.