release-bump --date is documented but never validated #142

New issue

Closed

opened 2026-08-15 14:33:42 +00:00 by john · 1 comment

john commented

2026-08-15 14:33:42 +00:00

Owner

Source: deep dive F15
Verdict: AGREE - low

Claim as reviewed

The CLI documents --date <YYYY-MM-DD> but bump accepts any truthy string and inserts it directly into the changelog heading, so newlines or Markdown can corrupt the generated section.

At HEAD `f354864` (v3.3.0)

cadence-core/bin/release-bump.mjs:102 - const date = dateArg || new Date().toISOString().slice(0, 10); with no shape check. The value reaches the heading at cadence-core/bin/lib/release-decision.mjs:254 - const heading = `## [${version}] - ${date}\n\n`;.

Note

Local operator input only, so the exposure is a corrupted changelog rather than an injection. Reject anything that is not a round-tripping calendar date before any file is written.

**Source:** deep dive F15 **Verdict:** AGREE - low ### Claim as reviewed The CLI documents `--date <YYYY-MM-DD>` but `bump` accepts any truthy string and inserts it directly into the changelog heading, so newlines or Markdown can corrupt the generated section. ### At HEAD f354864 (v3.3.0) `cadence-core/bin/release-bump.mjs:102` - `const date = dateArg || new Date().toISOString().slice(0, 10);` with no shape check. The value reaches the heading at `cadence-core/bin/lib/release-decision.mjs:254` - `` const heading = `## [${version}] - ${date}\n\n`; ``. ### Note Local operator input only, so the exposure is a corrupted changelog rather than an injection. Reject anything that is not a round-tripping calendar date before any file is written.