release: publish v0.7.2

Patch two high-severity advisories in transitive dev-only dependencies: fast-uri 3.1.2 -> 3.1.4 (GHSA-v2hh-gcrm-f6hx, GHSA-4c8g-83qw-93j6) and js-yaml 4.2.0 -> 4.3.0 (GHSA-52cp-r559-cp3m). Neither is executed by the installed plugin.

Correct the package-lock.json self-version, which carried a stale 0.20.0 from the upstream lineage.

Published-from-internal: 530a59876e36bfa7821e727ed35ede45b2395954

Author: elad-reznikov

.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "deep-init",
-  "version": "0.7.1",
+  "version": "0.7.2",
   "description": "Generates a grounded, verified, two-tier agent context layer (lean CLAUDE.md + deep .ai/docs) for any codebase, plus report-only issue detection. 100% local, read-only.",
   "author": {
     "name": "DeepFusion Labs",

CHANGELOG.md

@@ -4,6 +4,24 @@ All notable changes to DeepInit are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this project uses **manual** `0.x`
 versioning (no release tooling derives this file).
 
+## [0.7.2] — 2026-07-26
+
+### Security
+- **fast-uri 3.1.2 → 3.1.4** — patches GHSA-v2hh-gcrm-f6hx (host confusion via a literal
+  backslash authority delimiter) and GHSA-4c8g-83qw-93j6 (host confusion via failed IDN
+  canonicalization). Reached transitively via `@commitlint/cli` → `ajv`.
+- **js-yaml 4.2.0 → 4.3.0** — patches GHSA-52cp-r559-cp3m (quadratic CPU consumption from
+  YAML merge-key chains). Reached transitively via `@commitlint/cli` → `cosmiconfig`.
+
+Both are development-only dependencies of the commit tooling. Neither is executed by the
+installed plugin, so this release changes no analysis or generation behavior.
+
+### Fixed
+- `package-lock.json` recorded a stale `0.20.0` self-version inherited from the upstream
+  lineage; it now tracks this repository's own release version.
+
+---
+
 ## [0.7.1] — 2026-07-01
 
 ### Changed

commands/version.md

@@ -6,7 +6,7 @@ Report the running DeepInit version — fast, no analysis. Do exactly this, then
 
 1. State the **loaded** version verbatim. This line ships inside the plugin markdown that is actually loaded in your session, so it is the source of truth for "what is running right now":
 
-   **DeepInit v0.7.1** <!-- deepinit:loaded-version -->
+   **DeepInit v0.7.2** <!-- deepinit:loaded-version -->
 
 2. Read the **on-disk** version (best-effort — skip gracefully if a path isn't present):
    - a local clone of this repo → `.claude-plugin/plugin.json` (the `"version"` field)

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "deep-init",
-  "version": "0.7.1",
+  "version": "0.7.2",
   "private": true,
   "description": "DeepInit — a Claude Code skill that generates a grounded, verified, two-tier agent context layer (lean CLAUDE.md + deep .ai/docs) for any codebase, plus report-only issue detection. 100% local, read-only, MIT.",
   "license": "MIT",