chore(main): pre-release 3.3.111

[hve-core-release-please]

Pre-Release 3.3.111

✨ Features

• add structured JSON log output to Validate-Collections.ps1
• add github-security code-scanning skill (feat(skills): add github-security code-scanning skill #1418)
• add lint:py:fix to apply ruff autofixes across Python skills (feat(scripts): add lint:py:fix to apply ruff autofixes across Python skills #1450)
• add structured JSON log output to Validate-Marketplace.ps1 (feat(scripts): add structured JSON log output to Validate-Marketplace.ps1 #1430)
• expand fuzz_has_formatting_variation to cover all formatting properties (feat(skills): expand fuzz_has_formatting_variation to cover all formatting properties #1143) (feat(skills): expand fuzz_has_formatting_variation to cover all formatting properties (#1143) #1296)
• add Task Challenger adversarial questioning agent (feat(agents): add Task Challenger adversarial questioning agent #1315)
• add removed maturity tier and retire owasp-docker (feat(skills): add removed maturity tier and retire owasp-docker #1444)
• add evaluation dataset creator (feat(agents): add evaluation dataset creator #1279)
• align RAI planner with guide, remove scoring, improve UX (feat(agents): align RAI planner with guide, remove scoring, improve UX #1287)
• add PSGallery staleness check and BOM cleanup (feat(security): add PSGallery staleness check and BOM cleanup #1379)
• ISA-95 network planner agent (feat(project-planning): ISA-95 network planner agent #1177)
• auto-generate collection.md with maturity filtering (feat(collections): auto-generate collection.md with maturity filtering #1316)
• add folder-consistency check and standardize WARN outp… (feat(scripts): add folder-consistency check and standardize WARN outp… #1350)
• add synth-data-generate prompt to data-science collection (feat(prompts): add synth-data-generate prompt to data-science collection #1419)
• add canonical deck workflow and customer-card rendering for design thinking (feat(skills): add canonical deck workflow and customer-card rendering for design thinking #1413)
• add Figma MCP integration for DT artifact export (feat(dt): add Figma MCP integration for DT artifact export #1222)
• introduce owasp-docker (feat(skill): introduce owasp-docker #1245)
• replace hve-core-specific references with portable discovery-based language (feat(agents): replace hve-core-specific references with portable discovery-based language #1335)
• introduce owasp-cicd (feat(skill): introduce owasp-cicd #1246)
• add secure-by-design knowledge skill (feat(skills): add secure-by-design knowledge skill #1223)
• introduce owasp-infrastructure (feat(skill): introduce owasp-infrastructure #1244)
• introduce owasp-mcp (feat(skill): introduce owasp-mcp #1207)
• add OutputPath parameter to Invoke-LinkLanguageCheck.ps1 (feat(1004): add OutputPath parameter to Invoke-LinkLanguageCheck.ps1 #1229)
• add -OutputPath parameter to Validate-SkillStructure.ps1 (feat: add -OutputPath parameter to Validate-SkillStructure.ps1 #1225)
• add maintainer-only skip-review label guard (feat(workflows): add maintainer-only skip-review label guard #1293)
• add extension collections overview and integrate into getting started flow (feat(docs): add extension collections overview and integrate into getting started flow #950)
• add agentic workflows for automated issue triage, implementation, PR review, dependency review, and doc-staleness detection (feat(workflows): add agentic workflows for automated issue triage, implementation, PR review, dependency review, and doc-staleness detection #1219)
• consolidate package-lock.json version sync into Update-VersionFiles.ps1 (feat(scripts): consolidate package-lock.json version sync into Update-VersionFiles.ps1 #1240)
• add standards code review agent and full review orchestrator (feat(agents): add standards code review agent and full review orchestrator #1174)
• standardize pytest-mock as Python mocking framework (feat(skills): standardize pytest-mock as Python mocking framework #1170)
• add Jira backlog workflows and Jira/GitLab skills (feat(integrations): add Jira backlog workflows and Jira/GitLab skills #978)
• add centralized version bump script and supply-chain attestation (feat(build): add centralized version bump script and supply-chain attestation #1183)

🐛 Bug Fixes

• pin uuid and postcss via overrides to resolve Dependabot alerts (fix(build): pin uuid and postcss via overrides to resolve Dependabot alerts #1491)
• pin PowerShell-Yaml to 0.4.7 across all install sites (fix(ci): pin PowerShell-Yaml to 0.4.7 across all install sites #1378)
• close fork-PR/workflow-file-PR secret-strip gap and normalize upload-artifact version (fix(workflows): close fork-PR/workflow-file-PR secret-strip gap and normalize upload-artifact version #1421)
• replace stream-based lookahead with array indexing in list-changed-files.sh (fix(skills): replace stream-based lookahead with array indexing in list-changed-files.sh #1376)
• centralize ISO 8601 timestamp regex in CIHelpers (fix(scripts): centralize ISO 8601 timestamp regex in CIHelpers #1343)
• update stale documentation date in release-process.md (fix: update stale documentation date in release-process.md #1363)
• pin basic-ftp to 5.3.0 to resolve GHSA-rp42-5vxx-qpwr (fix(build): pin basic-ftp to 5.3.0 to resolve GHSA-rp42-5vxx-qpwr #1374)
• add bot filter to dependency PR review workflow (fix(workflows): add bot filter to dependency PR review workflow #1362)
• resolve pip-audit findings in powerpoint, gitlab, and jira skill lock files (fix(skills): resolve pip-audit findings in powerpoint, gitlab, and jira skill lock files #1360)
• standardize Timestamp JSON key casing across all lint result files (fix(scripts): standardize Timestamp JSON key casing across all lint result files #1314)
• add synchronize trigger to PR Review workflow (fix(ci): add synchronize trigger to PR Review workflow #1323)
• standardize timestamp in Validate-SkillStructure.ps1 to use Get-StandardTimestamp (fix(scripts): standardize timestamp in Validate-SkillStructure.ps1 to use Get-StandardTimestamp #1280)
• add parallel subagent dispatch and structured JSON contracts to code-review-full (fix(agents): add parallel subagent dispatch and structured JSON contracts to code-review-full #1304)
• standardize timestamp in SecurityHelpers.psm1 to use Get-StandardTimestamp (fix(scripts): standardize timestamp in SecurityHelpers.psm1 to use Get-StandardTimestamp #1284)
• standardize timestamps in Test-DependencyPinning.ps1 and SecurityClasses.psm1 (fix(scripts): standardize timestamps in Test-DependencyPinning.ps1 and SecurityClasses.psm1 #1282)
• derive collection artifact counts from YAML at build time (fix(docs): derive collection artifact counts from YAML at build time #1275)
• standardize timestamp in FrontmatterValidation.psm1 to use Get-StandardTimestamp (fix(scripts): standardize timestamp in FrontmatterValidation.psm1 to use Get-StandardTimestamp #1285)
• standardize timestamp in Markdown-Link-Check.ps1 to use Get-StandardTimestamp (fix(scripts): standardize timestamp in Markdown-Link-Check.ps1 to use Get-StandardTimestamp #1283)
• escape hyphens in Mermaid diagram on Collections page (fix(docs): escape hyphens in Mermaid diagram on Collections page #1262)
• add summary timestamp to PSScriptAnalyzer output (fix(linting): add summary timestamp to PSScriptAnalyzer output #1211)
• fix plugin compatibility and robustness for coding-standards code review agents (fix(agents): fix plugin compatibility and robustness for coding-standards code review agents #1289)
• standardize timestamp in Test-CopyrightHeaders.ps1 to use Get-StandardTimestamp (fix(scripts): standardize timestamp in Test-CopyrightHeaders.ps1 to use Get-StandardTimestamp #1278)
• standardize timestamp in Invoke-YamlLint.ps1 to use Get-StandardTimestamp (fix(scripts): standardize timestamp in Invoke-YamlLint.ps1 to use Get-StandardTimestamp #1270)
• standardize timestamp in Invoke-LinkLanguageCheck.ps1 to use Get-StandardTimestamp (fix(scripts): standardize timestamp in Invoke-LinkLanguageCheck.ps1 to use Get-StandardTimestamp #1264)
• fix dependency-review path filters and sparse-checkout cone mode (fix(workflows): fix dependency-review path filters and sparse-checkout cone mode #1259)
• replace invalid bare tool names with official tool identifiers (fix(agents): replace invalid bare tool names with official tool identifiers #1198)
• fix broken links and remove orphaned reference in code review docs (fix(docs): fix broken links and remove orphaned reference in code review docs #1257)
• exclude Python env dirs from skill validation warnings (fix(scripts): exclude Python env dirs from skill validation warnings #1255)
• pin happy-dom and serialize-javascript to resolve Dependabot vulnerabilities (fix(build): pin happy-dom and serialize-javascript to resolve Dependabot vulnerabilities #1253)
• remove Mermaid diagram and add missing collection cards (fix(docs): remove Mermaid diagram and add missing collection cards #1247)
• disable MCP servers by default to prevent token limit errors (fix: disable MCP servers by default to prevent token limit errors #1144)
• sync package-lock.json after pre-release version bump (fix(workflows): sync package-lock.json after pre-release version bump #1236)
• separate mermaid node declarations and add dynamic diagram generation with tests (fix(docs): separate mermaid node declarations and add dynamic diagram generation with tests #1215)
• replace anchor links in meeting-analyst with bold text references (fix(agents): replace anchor links in meeting-analyst with bold text references #1201)
• remove recursive symlinks in jira and gitlab skill directories (fix(skills): remove recursive symlinks in jira and gitlab skill directories #1233)
• validate-installation scripts now check .github/skills directory (fix: installer skill scripts validate-installation should check for .github/skills directory #1010) (fix: validate-installation scripts now check .github/skills directory (#1010) #1206)
• resolve npm audit vulnerabilities via dependency overrides (fix(build): resolve npm audit vulnerabilities via dependency overrides #1200)
• add post-release triggers to scorecard workflow (fix(workflows): add post-release triggers to scorecard workflow #1186)
• add missing .md extensions to relative links in agent documentation (fix(docs): add missing .md extensions to relative links in agent documentation #1180)

📚 Documentation

• broaden Security Review description beyond OWASP (docs(architecture): broaden Security Review description beyond OWASP #1385)
• document maintainer advisory mode and skip-review label guard (docs(architecture): document maintainer advisory mode and skip-review label guard #1386)
• document ExcludePaths/OutputPath for Invoke-LinkLanguageCheck (docs: document ExcludePaths/OutputPath for Invoke-LinkLanguageCheck #1383)
• CLI getting-started: clarify plugin install commands as alternatives (-all vs base) (docs(docs): CLI getting-started: clarify plugin install commands as alternatives (-all vs base) #1251)

♻️ Refactoring

• align agent and prompt folder names to collection identifier (refactor(coding-standards): align agent and prompt folder names to collection identifier #1210)

🔧 Maintenance

• bump markdownlint-cli2 from 0.22.0 to 0.22.1 in the npm-dependencies group (chore(deps-dev): bump markdownlint-cli2 from 0.22.0 to 0.22.1 in the npm-dependencies group #1452)
• bump the github-actions group with 3 updates (chore(deps): bump the github-actions group with 3 updates #1453)
• pre-release 3.3.101 (chore(main): pre-release 3.3.101 #1274)
• pin PSScriptAnalyzer to 1.25.0 and sync stale workflow version comments (chore(security): pin PSScriptAnalyzer to 1.25.0 and sync stale workflow version comments #1389)
• bump lxml from 6.0.2 to 6.1.0 in /.github/skills/experimental/powerpoint (chore(deps): bump lxml from 6.0.2 to 6.1.0 in /.github/skills/experimental/powerpoint #1424)
• bump @vscode/vsce from 3.7.1 to 3.9.1 in the npm-dependencies group (chore(deps-dev): bump @vscode/vsce from 3.7.1 to 3.9.1 in the npm-dependencies group #1390)
• bump the github-actions group across 1 directory with 7 updates (chore(deps): bump the github-actions group across 1 directory with 7 updates #1391)
• bump follow-redirects from 1.15.11 to 1.16.0 in /docs/docusaurus (chore(deps): bump follow-redirects from 1.15.11 to 1.16.0 in /docs/docusaurus #1356)
• upgrade Node.js from 20 to 24 and bump cspell to v10 (chore(build): upgrade Node.js from 20 to 24 and bump cspell to v10 #1353)
• bump basic-ftp from 5.2.0 to 5.2.1 (chore(deps-dev): bump basic-ftp from 5.2.0 to 5.2.1 #1324)
• update github/gh-aw-actions requirement to 536ea1bad8c6715d098a9dc1afea8d403733acfe in the github-actions group across 1 directory (chore(deps): update github/gh-aw-actions requirement to 536ea1bad8c6715d098a9dc1afea8d403733acfe in the github-actions group across 1 directory #1298)
• update security instruction attributions and compliance (chore(licensing): update security instruction attributions and compliance #1294)
• bump the npm-dependencies group with 2 updates (chore(deps-dev): bump the npm-dependencies group with 2 updates #1297)
• pre-release 3.3.41 (chore(main): pre-release 3.3.41 #1252)
• streamline RAI Planner phase structure and documentation (chore(rai-planning): streamline RAI Planner phase structure and documentation #1273)
• bump happy-dom from 20.8.8 to 20.8.9 in /docs/docusaurus (chore(deps-dev): bump happy-dom from 20.8.8 to 20.8.9 in /docs/docusaurus #1237)
• pre-release 3.3.27 (chore(main): pre-release 3.3.27 #1191)
• bump pygments from 2.19.2 to 2.20.0 in /.github/skills/gitlab/gitlab (chore(deps): bump pygments from 2.19.2 to 2.20.0 in /.github/skills/gitlab/gitlab #1234)
• bump path-to-regexp from 0.1.12 to 0.1.13 in /docs/docusaurus (chore(deps): bump path-to-regexp from 0.1.12 to 0.1.13 in /docs/docusaurus #1226)
• bump the github-actions group with 4 updates (chore(deps): bump the github-actions group with 4 updates #1231)
• add missing folders and alphabetize location lists (chore(settings): add missing folders and alphabetize location lists #1193)
• bump brace-expansion (chore(deps): bump brace-expansion #1224)
• bump handlebars from 4.7.8 to 4.7.9 in /docs/docusaurus (chore(deps-dev): bump handlebars from 4.7.8 to 4.7.9 in /docs/docusaurus #1217)
• bump brace-expansion from 5.0.3 to 5.0.5 in /docs/docusaurus (chore(deps): bump brace-expansion from 5.0.3 to 5.0.5 in /docs/docusaurus #1213)
• pre-release 3.3.10 (chore(main): pre-release 3.3.10 #1187)
• bump markdownlint-cli2 from 0.21.0 to 0.22.0 in the npm-dependencies group (chore(deps-dev): bump markdownlint-cli2 from 0.21.0 to 0.22.0 in the npm-dependencies group #1175)
• bump the github-actions group with 3 updates (chore(deps): bump the github-actions group with 3 updates #1176)
• pre-release 3.3.1 (chore(main): pre-release 3.3.1 #1165)

---

Managed automatically by pre-release workflow.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
npm/hve-core	3.3.111	Unknown	Unknown

Scanned Files

• package.json

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 87.43%. Comparing base (57ea279) to head (ea80701).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1476      +/-   ##
==========================================
- Coverage   87.44%   87.43%   -0.01%     
==========================================
  Files          68       68              
  Lines       10335    10335              
==========================================
- Hits         9037     9036       -1     
- Misses       1298     1299       +1     

Flag	Coverage Δ
pester	84.79% <ø> (-0.02%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.
see 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.