v0.6.0 Released — Compact Mode + Security Hardening

[Dave-London]

v0.6.0 is live on npm!

All 10 packages have been published at version 0.6.0.

Automatic Compact Mode

The headline feature in v0.6.0. When structured JSON output would exceed the raw CLI token count, Pare now automatically applies a compact projection — keeping essential fields and dropping verbose details like stack traces, individual diagnostics, and file-level stats. This ensures Pare always uses fewer tokens than raw CLI output.

Every tool across all 9 servers supports it. Each tool accepts a compact parameter (default: true) to opt out if you need full detail.

Security Hardening

We conducted a full security audit and remediated all findings:

ID	Fix
SEC-001/006/011	Validate all args[] arrays against flag injection
SEC-002/008/009/010/014	Supply chain safeguards and exec validation
SEC-003/004/005/013	Docker/Go validation, SHA pinning, security model docs
SEC-007/012	Windows cmd.exe delayed expansion escaping, Zod input limits
—	Block dangerous Docker volume mounts (/, /etc, /var/run/docker.sock)
—	Default ignoreScripts: true for npm install
—	Error message sanitization to prevent path leakage

The full security audit report is now public.

Reliability

• Default run() timeout increased from 30s to 60s
• Fixed flaky Windows Node 22 test timeouts
• CI reliability improvements across all platforms

Community Contributions

Thanks to our contributors this release:

• @jasonwarta — Hardened input validation against flag injection bypasses (fix: harden input validation against flag injection bypasses #115)
• @Chidwan3578 — Improved CONTRIBUTING.md with project structure and test types (Added a CONTRIBUTING.md #143)

Testing

1,796 tests across 103 files — up from 1,334 in v0.5.0. New coverage includes compact mode, security validation, and input limits.

Install

npx -y @paretools/git
npx -y @paretools/test
npx -y @paretools/npm
npx -y @paretools/build
npx -y @paretools/lint
npx -y @paretools/python
npx -y @paretools/docker
npx -y @paretools/cargo
npx -y @paretools/go

Full release notes