noyalib
The noyalib rosette mark on a dark ground.

Release · 6 September 2026

noyalib v0.0.38

The last unpinned commands leave the family's workflows. Registry probes now verify what they fetch by hash, and every satellite's main branch is protected the way the core's is.

By , maintainer of noyalib and its five companion crates. Last reviewed .

What changed

v0.0.38 answers the open OpenSSF Scorecard findings across the family. No library code changed; every crate moves together so that =0.0.38 names one known set.

Fixed

  • No more npm install in any workflow. The core's registry drift net fetches the exact declared version of each npm package, verifies the tarball against the sha512 the registry publishes, unpacks it by hand and checks that the package carries every file its entry module imports. The wasm and MCP releases assert the runner's npm supports OIDC trusted publishing instead of upgrading it. The VS Code extension builds with npm ci from a committed lockfile.
  • Satellite branch protection matches the core: strict status checks, signed commits, code-owner review, conversation resolution, admins included.

Also

  • An ultra-complex fixture through every crate. A two-document configuration with anchors and merge keys at two depths, explicit tags including !!pairs, literal and folded block scalars and a sequence as a mapping key parses to exactly its expected JSON in the core, the CLI, the language server, the MCP server, the serde-yaml shim and the WebAssembly package; it is the playground's second example. Running it through noyafmt found three formatter defects around explicit keys and lone properties, fixed in the core.
  • Two diagnostics that name the mistake. !!!int is refused with "did you mean !!int?", and an alias that names an anchor from an earlier document says where that anchor is defined and that anchors do not cross ---.

Upgrading

Bump every noyalib crate you use to 0.0.38. Nothing else changes.