> ## Documentation Index
> Fetch the complete documentation index at: https://bazable.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Changelog

> Release history for the Bazable CLI, following Keep a Changelog and Semantic Versioning.

All notable changes to Bazable are documented here. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

## Unreleased

### Planned

* [`bazable doctor`](/commands) diagnostic command.
* `bazable env` for environment management.

## 1.3.5 — 2026-08-29

### Added

* Newman / Postman integration:
  * [`bazable export --postman`](/commands/export) to generate a Postman Collection v2.1.
  * [`bazable test --newman`](/commands/test) to run tests through Newman.
  * [`bazable ci --newman`](/commands/ci) to include a Newman step in the generated GitHub Actions workflow.
  * [`bazable serve --verify`](/commands/serve) to automatically run Newman against the mock server.
  * [`bazable gen backend --postman`](/commands/generate-backend) to generate a Postman collection alongside backend stubs.
  * `--reporter` and `--env-var` options for Newman in [`bazable test`](/commands/test).
* New internal utilities: `src/utils/postman.js`, `src/utils/newmanRunner.js`, `src/utils/security.js`, `src/utils/spawnSafe.js`.
* Added `postman-collection` as a dependency.

### Changed

* [`export`](/commands/export) now supports both OpenAPI and Postman formats (OpenAPI remains the default).
* [`test`](/commands/test) supports optional Newman execution (additive, backward compatible).
* [`serve`](/commands/serve) supports an optional `--verify` flag (default off).
* [`gen backend`](/commands/generate-backend) supports optional `--postman` and `--test` flags.
* All child processes now use safe spawn (no shell) via `spawnSafe.js`.

## 1.3.4

### Added

* Trusted publishing support: `publishConfig.provenance` and `publishConfig.access` in `package.json`.
* `npm run security` script for local audit.
* `engines` and `files` fields to reduce package surface.
* `SECURITY.md` for vulnerability reporting policy.

### Changed

* [`watch`](/cloud/watch) now uses the Bazable Cloud API (`/projects/:id/contracts/latest`) instead of Supabase, reusing the cloud token.
* [`watch`](/cloud/watch): auto-fix (`inspect --fix`) is now opt‑in via the `--auto-fix` flag.
* Replaced `execSync` in [`watch`](/cloud/watch) with safe spawn (`child_process.spawn` without a shell).
* Updated `.github/workflows/publish.yml` to use OIDC trusted publishing (no `NPM_TOKEN`).

### Fixed

* Replaced `cubrin.com` email in the mock server with `example.com` to avoid scanner flags.
* Added URL validation (SSRF protection) in [`watch`](/cloud/watch) for remote URLs and WebSocket URLs.
* Added WebSocket message validation and rate limiting to prevent abuse.

### Removed

* `postinstall` script removed to eliminate install-time code execution risk.

## 1.3.3

### Added

* [`bazable review`](/commands/review) to show provenance and inference confidence.
* Provenance tracking: each extracted API URL now records `file`, `line`, and `column`.
* Field-level inference metadata (`confidence`, `source_value`, `source_type`) stored in `request_meta`.

### Changed

* [`extract`](/commands/extract) now stores provenance and `request_meta` in `bazable.config.json`.
* `inferRequestSchemasFromFile` resolves variables across script blocks in the same file.

### Fixed

* Accurate line numbers in HTML script blocks for provenance.

## 1.3.2

### Security

* ReDoS protections for glob/regex inputs (`isSafeGlobPattern`, `isSafeRegex`).
* SSRF protections for URLs (`isUrlAllowed`).
* Path traversal prevention via `safeJoin`.
* Redaction helper for secrets in logs.

## 1.3.0

### Added

* [`bazable lsp`](/commands/lsp) (Language Server Protocol).
* [`bazable mcp`](/commands/mcp) (Model Context Protocol server).
* [`bazable curl`](/commands/curl) (raw HTTP request with logging, CORS bypass).
* [`gen context`](/commands/generate-context) subcommand for AI agent context files.
* [`gen db`](/commands/generate-db) subcommand for Prisma / Supabase SQL.
* WebSocket real-time sync in [`watch`](/cloud/watch).
* CSV seed support for [`serve`](/commands/serve).

### Changed

* Cloud sync ([`push`](/commands/push), [`sync`](/commands/sync), [`watch`](/cloud/watch)) now uses device-code OAuth and WebSocket.
* `bazable --version` reads from `package.json`.

## 1.2.0

### Added

* [`explain`](/commands/explain), [`propose`](/commands/propose), and [`accept`](/commands/accept) for AI-assisted contract negotiation.
* [`review`](/commands/review) (early version).
* [`export`](/commands/export) to produce an OpenAPI spec.
* [`hook`](/commands/hook) to install a pre-push Git hook.
* [`ci`](/commands/ci) to generate a GitHub Actions workflow.
* [`ui`](/commands/ui) for the local dashboard.
* [`docs`](/commands/docs) to generate static API documentation.
* [`import`](/commands/import) for OpenAPI / Swagger / Postman / CSV.
* [`test`](/commands/test) with mock mode and auto-login.
* [`types`](/commands/types) and [`client`](/commands/client) generation.

### Changed

* Extraction engine improved with presets, template literals, and multi-base URL support.
* [`serve`](/commands/serve) now supports CSV seeding.

## 1.1.0

### Added

* Basic contract management: [`init`](/commands/init), [`add`](/commands/add), [`extract`](/commands/extract), [`inspect`](/commands/inspect), [`config`](/commands/config), [`login`](/cloud/login), [`errors`](/commands/errors).
* [`diff`](/commands/diff) to compare the stored schema with a live API.
* [`errors`](/commands/errors) to view and clear the persistent error log.

## 1.0.0

### Added

* Initial release: [`init`](/commands/init), [`add`](/commands/add), [`extract`](/commands/extract), [`inspect`](/commands/inspect), [`test`](/commands/test), [`diff`](/commands/diff), [`types`](/commands/types), [`client`](/commands/client), [`gen backend`](/commands/generate-backend), [`gen ui`](/commands/generate-ui), [`serve`](/commands/serve).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.