{
  "$schema": "https://verifymcp.io/schemas/changelog.json",
  "server": "bpmnkit-bpmnkit",
  "component": "bpmnkit-cli",
  "generated_at": "2026-11-05T09:21:14.865Z",
  "tracking_since": "2026-09-29",
  "counts": {
    "critical": 0,
    "security": 23,
    "functional": 0,
    "cosmetic": 0
  },
  "events": [
    {
      "id": "chg_01a1a4c0-0838-7ad8-8243-dbce25e23ec2",
      "kind": "advisory.identified",
      "family": "vulnerabilities",
      "subject_kind": "advisory",
      "subject": "CVE-2026-121425",
      "subject_child": "",
      "from_code": null,
      "to_code": "cve.transitive",
      "from_value": null,
      "to_value": "high",
      "materiality": "security",
      "direction": "regression",
      "score_delta": null,
      "detail": {
        "id": "CVE-2026-121425",
        "severity": "high"
      },
      "occurred_on": "2026-11-04",
      "occurred_at": "2026-11-04 04:10:10.834135+00",
      "observed_since": "2026-11-03",
      "source": "scan",
      "summary": "CVE-2026-121425 affects this package (high)",
      "link": "https://verifymcp.io/servers/bpmnkit-bpmnkit/bpmnkit-cli#chg-chg_01a1a4c0-0838-7ad8-8243-dbce25e23ec2"
    },
    {
      "id": "chg_01a1a4c0-083b-794a-8ae9-02948f4ec2c0",
      "kind": "advisory.identified",
      "family": "vulnerabilities",
      "subject_kind": "advisory",
      "subject": "CVE-2026-121424",
      "subject_child": "",
      "from_code": null,
      "to_code": "cve.transitive",
      "from_value": null,
      "to_value": "high",
      "materiality": "security",
      "direction": "regression",
      "score_delta": null,
      "detail": {
        "id": "CVE-2026-121424",
        "severity": "high"
      },
      "occurred_on": "2026-11-04",
      "occurred_at": "2026-11-04 04:10:10.834135+00",
      "observed_since": "2026-11-03",
      "source": "scan",
      "summary": "CVE-2026-121424 affects this package (high)",
      "link": "https://verifymcp.io/servers/bpmnkit-bpmnkit/bpmnkit-cli#chg-chg_01a1a4c0-083b-794a-8ae9-02948f4ec2c0"
    },
    {
      "id": "chg_01a1a4c0-083c-7052-a546-3aa20178bea2",
      "kind": "advisory.identified",
      "family": "vulnerabilities",
      "subject_kind": "advisory",
      "subject": "CVE-2026-121426",
      "subject_child": "",
      "from_code": null,
      "to_code": "cve.transitive",
      "from_value": null,
      "to_value": "high",
      "materiality": "security",
      "direction": "regression",
      "score_delta": null,
      "detail": {
        "id": "CVE-2026-121426",
        "severity": "high"
      },
      "occurred_on": "2026-11-04",
      "occurred_at": "2026-11-04 04:10:10.834135+00",
      "observed_since": "2026-11-03",
      "source": "scan",
      "summary": "CVE-2026-121426 affects this package (high)",
      "link": "https://verifymcp.io/servers/bpmnkit-bpmnkit/bpmnkit-cli#chg-chg_01a1a4c0-083c-7052-a546-3aa20178bea2"
    },
    {
      "id": "chg_01a1a4c0-083c-75c1-8a71-694bd3a96118",
      "kind": "advisory.resolved",
      "family": "vulnerabilities",
      "subject_kind": "advisory",
      "subject": "GHSA-85x2-q946-cp5h",
      "subject_child": "",
      "from_code": "cve.transitive",
      "to_code": "cve.transitive",
      "from_value": "high",
      "to_value": null,
      "materiality": "security",
      "direction": "improvement",
      "score_delta": null,
      "detail": {
        "id": "GHSA-85x2-q946-cp5h"
      },
      "occurred_on": "2026-11-04",
      "occurred_at": "2026-11-04 04:10:10.834135+00",
      "observed_since": "2026-11-03",
      "source": "scan",
      "summary": "GHSA-85x2-q946-cp5h no longer affects this package",
      "link": "https://verifymcp.io/servers/bpmnkit-bpmnkit/bpmnkit-cli#chg-chg_01a1a4c0-083c-75c1-8a71-694bd3a96118"
    },
    {
      "id": "chg_01a1a4c0-083c-7b72-83e6-04ed50ddbd5b",
      "kind": "advisory.resolved",
      "family": "vulnerabilities",
      "subject_kind": "advisory",
      "subject": "GHSA-m943-m63m-w62w",
      "subject_child": "",
      "from_code": "cve.transitive",
      "to_code": "cve.transitive",
      "from_value": "high",
      "to_value": null,
      "materiality": "security",
      "direction": "improvement",
      "score_delta": null,
      "detail": {
        "id": "GHSA-m943-m63m-w62w"
      },
      "occurred_on": "2026-11-04",
      "occurred_at": "2026-11-04 04:10:10.834135+00",
      "observed_since": "2026-11-03",
      "source": "scan",
      "summary": "GHSA-m943-m63m-w62w no longer affects this package",
      "link": "https://verifymcp.io/servers/bpmnkit-bpmnkit/bpmnkit-cli#chg-chg_01a1a4c0-083c-7b72-83e6-04ed50ddbd5b"
    },
    {
      "id": "chg_01a1a4c0-083d-7217-85e4-9739f433c779",
      "kind": "advisory.resolved",
      "family": "vulnerabilities",
      "subject_kind": "advisory",
      "subject": "GHSA-8c8m-p3m8-cjg8",
      "subject_child": "",
      "from_code": "cve.transitive",
      "to_code": "cve.transitive",
      "from_value": "high",
      "to_value": null,
      "materiality": "security",
      "direction": "improvement",
      "score_delta": null,
      "detail": {
        "id": "GHSA-8c8m-p3m8-cjg8"
      },
      "occurred_on": "2026-11-04",
      "occurred_at": "2026-11-04 04:10:10.834135+00",
      "observed_since": "2026-11-03",
      "source": "scan",
      "summary": "GHSA-8c8m-p3m8-cjg8 no longer affects this package",
      "link": "https://verifymcp.io/servers/bpmnkit-bpmnkit/bpmnkit-cli#chg-chg_01a1a4c0-083d-7217-85e4-9739f433c779"
    },
    {
      "id": "chg_01a180b1-c64d-7335-8c88-c081cca679de",
      "kind": "advisory.identified",
      "family": "vulnerabilities",
      "subject_kind": "advisory",
      "subject": "CVE-2026-110872",
      "subject_child": "",
      "from_code": null,
      "to_code": "cve.transitive",
      "from_value": null,
      "to_value": "high",
      "materiality": "security",
      "direction": "regression",
      "score_delta": null,
      "detail": {
        "id": "CVE-2026-110872",
        "severity": "high"
      },
      "occurred_on": "2026-10-28",
      "occurred_at": "2026-10-28 04:08:16.502084+00",
      "observed_since": "2026-10-27",
      "source": "scan",
      "summary": "CVE-2026-110872 affects this package (high)",
      "link": "https://verifymcp.io/servers/bpmnkit-bpmnkit/bpmnkit-cli#chg-chg_01a180b1-c64d-7335-8c88-c081cca679de"
    },
    {
      "id": "chg_01a180b1-c64f-7651-8a25-d6a67f06052a",
      "kind": "advisory.identified",
      "family": "vulnerabilities",
      "subject_kind": "advisory",
      "subject": "CVE-2026-110870",
      "subject_child": "",
      "from_code": null,
      "to_code": "cve.transitive",
      "from_value": null,
      "to_value": "high",
      "materiality": "security",
      "direction": "regression",
      "score_delta": null,
      "detail": {
        "id": "CVE-2026-110870",
        "severity": "high"
      },
      "occurred_on": "2026-10-28",
      "occurred_at": "2026-10-28 04:08:16.502084+00",
      "observed_since": "2026-10-27",
      "source": "scan",
      "summary": "CVE-2026-110870 affects this package (high)",
      "link": "https://verifymcp.io/servers/bpmnkit-bpmnkit/bpmnkit-cli#chg-chg_01a180b1-c64f-7651-8a25-d6a67f06052a"
    },
    {
      "id": "chg_01a180b1-c64f-7cb6-aa89-78b56e871de6",
      "kind": "advisory.identified",
      "family": "vulnerabilities",
      "subject_kind": "advisory",
      "subject": "CVE-2026-110869",
      "subject_child": "",
      "from_code": null,
      "to_code": "cve.transitive",
      "from_value": null,
      "to_value": "high",
      "materiality": "security",
      "direction": "regression",
      "score_delta": null,
      "detail": {
        "id": "CVE-2026-110869",
        "severity": "high"
      },
      "occurred_on": "2026-10-28",
      "occurred_at": "2026-10-28 04:08:16.502084+00",
      "observed_since": "2026-10-27",
      "source": "scan",
      "summary": "CVE-2026-110869 affects this package (high)",
      "link": "https://verifymcp.io/servers/bpmnkit-bpmnkit/bpmnkit-cli#chg-chg_01a180b1-c64f-7cb6-aa89-78b56e871de6"
    },
    {
      "id": "chg_01a16c19-3b49-73bd-aa0c-d7a638f9d569",
      "kind": "advisory.identified",
      "family": "vulnerabilities",
      "subject_kind": "advisory",
      "subject": "GHSA-8c8m-p3m8-cjg8",
      "subject_child": "",
      "from_code": null,
      "to_code": "cve.transitive",
      "from_value": null,
      "to_value": "high",
      "materiality": "security",
      "direction": "regression",
      "score_delta": null,
      "detail": {
        "id": "GHSA-8c8m-p3m8-cjg8",
        "severity": "high"
      },
      "occurred_on": "2026-10-24",
      "occurred_at": "2026-10-24 04:09:15.312233+00",
      "observed_since": "2026-10-23",
      "source": "scan",
      "summary": "GHSA-8c8m-p3m8-cjg8 affects this package (high)",
      "link": "https://verifymcp.io/servers/bpmnkit-bpmnkit/bpmnkit-cli#chg-chg_01a16c19-3b49-73bd-aa0c-d7a638f9d569"
    },
    {
      "id": "chg_01a16c19-3b4a-7565-955e-4490aa19ca0c",
      "kind": "advisory.identified",
      "family": "vulnerabilities",
      "subject_kind": "advisory",
      "subject": "GHSA-85x2-q946-cp5h",
      "subject_child": "",
      "from_code": null,
      "to_code": "cve.transitive",
      "from_value": null,
      "to_value": "high",
      "materiality": "security",
      "direction": "regression",
      "score_delta": null,
      "detail": {
        "id": "GHSA-85x2-q946-cp5h",
        "severity": "high"
      },
      "occurred_on": "2026-10-24",
      "occurred_at": "2026-10-24 04:09:15.312233+00",
      "observed_since": "2026-10-23",
      "source": "scan",
      "summary": "GHSA-85x2-q946-cp5h affects this package (high)",
      "link": "https://verifymcp.io/servers/bpmnkit-bpmnkit/bpmnkit-cli#chg-chg_01a16c19-3b4a-7565-955e-4490aa19ca0c"
    },
    {
      "id": "chg_01a16c19-3b4a-7a96-b54e-dcc9c680bff1",
      "kind": "advisory.identified",
      "family": "vulnerabilities",
      "subject_kind": "advisory",
      "subject": "GHSA-m943-m63m-w62w",
      "subject_child": "",
      "from_code": null,
      "to_code": "cve.transitive",
      "from_value": null,
      "to_value": "high",
      "materiality": "security",
      "direction": "regression",
      "score_delta": null,
      "detail": {
        "id": "GHSA-m943-m63m-w62w",
        "severity": "high"
      },
      "occurred_on": "2026-10-24",
      "occurred_at": "2026-10-24 04:09:15.312233+00",
      "observed_since": "2026-10-23",
      "source": "scan",
      "summary": "GHSA-m943-m63m-w62w affects this package (high)",
      "link": "https://verifymcp.io/servers/bpmnkit-bpmnkit/bpmnkit-cli#chg-chg_01a16c19-3b4a-7a96-b54e-dcc9c680bff1"
    },
    {
      "id": "chg_01a166f3-366f-737b-90d2-a083277d5b00",
      "kind": "advisory.identified",
      "family": "vulnerabilities",
      "subject_kind": "advisory",
      "subject": "CVE-2026-110871",
      "subject_child": "",
      "from_code": null,
      "to_code": "cve.transitive",
      "from_value": null,
      "to_value": "high",
      "materiality": "security",
      "direction": "regression",
      "score_delta": null,
      "detail": {
        "id": "CVE-2026-110871",
        "severity": "high"
      },
      "occurred_on": "2026-10-23",
      "occurred_at": "2026-10-23 04:09:37.589966+00",
      "observed_since": "2026-10-22",
      "source": "scan",
      "summary": "CVE-2026-110871 affects this package (high)",
      "link": "https://verifymcp.io/servers/bpmnkit-bpmnkit/bpmnkit-cli#chg-chg_01a166f3-366f-737b-90d2-a083277d5b00"
    },
    {
      "id": "chg_01a13b6c-5482-7d3d-9d84-6b1e80a815da",
      "kind": "check.reason",
      "family": "stability",
      "subject_kind": "check",
      "subject": "stability",
      "subject_child": "",
      "from_code": "stability.sandbox_pending",
      "to_code": "stability.sandbox_failed",
      "from_value": "unverified",
      "to_value": "unverified",
      "materiality": "security",
      "direction": "neutral",
      "score_delta": null,
      "detail": {
        "reason": "needs_declared_env",
        "status": "unreachable"
      },
      "occurred_on": "2026-10-14",
      "occurred_at": "2026-10-14 17:18:37.685146+00",
      "observed_since": "2026-10-13",
      "source": "scan",
      "summary": "Stability (Stability not yet verified: this server's registry entry declares environment variables (an API key or similar), and its server did not start in our sandbox, so we have no schema to compare.)",
      "link": "https://verifymcp.io/servers/bpmnkit-bpmnkit/bpmnkit-cli#chg-chg_01a13b6c-5482-7d3d-9d84-6b1e80a815da"
    },
    {
      "id": "chg_01a13b6c-5483-79a8-b7fe-d64771bd2810",
      "kind": "check.reason",
      "family": "tool-safety-injection",
      "subject_kind": "check",
      "subject": "tool-safety-injection",
      "subject_child": "",
      "from_code": "toolsafety.sandbox_pending",
      "to_code": "toolsafety.sandbox_failed",
      "from_value": "unverified",
      "to_value": "unverified",
      "materiality": "security",
      "direction": "neutral",
      "score_delta": null,
      "detail": {
        "reason": "needs_declared_env",
        "status": "unreachable"
      },
      "occurred_on": "2026-10-14",
      "occurred_at": "2026-10-14 17:18:37.685146+00",
      "observed_since": "2026-10-13",
      "source": "scan",
      "summary": "Tool safety (Tool safety not yet verified: this server's registry entry declares environment variables (an API key or similar), and its server did not start in our sandbox, so we have no tool text to scan.)",
      "link": "https://verifymcp.io/servers/bpmnkit-bpmnkit/bpmnkit-cli#chg-chg_01a13b6c-5483-79a8-b7fe-d64771bd2810"
    },
    {
      "id": "chg_01a12171-0ee5-717d-9bfd-7b6de34802d8",
      "kind": "provenance.repo_changed",
      "family": "build-provenance",
      "subject_kind": "package",
      "subject": "repo",
      "subject_child": "",
      "from_code": "provenance.verified",
      "to_code": "provenance.verified",
      "from_value": "bpmnkit/monorepo",
      "to_value": "bpmnkit/bpmnkit",
      "materiality": "security",
      "direction": "neutral",
      "score_delta": null,
      "detail": {
        "to": "bpmnkit/bpmnkit",
        "from": "bpmnkit/monorepo"
      },
      "occurred_on": "2026-10-09",
      "occurred_at": "2026-10-09 16:13:38.636117+00",
      "observed_since": "2026-10-08",
      "source": "scan",
      "summary": "The attested source repository moved (bpmnkit/monorepo → bpmnkit/bpmnkit)",
      "link": "https://verifymcp.io/servers/bpmnkit-bpmnkit/bpmnkit-cli#chg-chg_01a12171-0ee5-717d-9bfd-7b6de34802d8"
    },
    {
      "id": "chg_01a118df-9dd1-7c8c-a896-891cb53ac38d",
      "kind": "check.reason",
      "family": "tool-safety-injection",
      "subject_kind": "check",
      "subject": "tool-safety-injection",
      "subject_child": "",
      "from_code": "toolsafety.sandbox_failed",
      "to_code": "toolsafety.sandbox_pending",
      "from_value": "unverified",
      "to_value": "unverified",
      "materiality": "security",
      "direction": "neutral",
      "score_delta": null,
      "detail": {
        "reason": "version_superseded"
      },
      "occurred_on": "2026-10-08",
      "occurred_at": "2026-10-08 00:17:48.345691+00",
      "observed_since": "2026-10-04",
      "source": "scan",
      "summary": "Tool safety (Tool safety not yet verified: we do not have a sandbox capture of the tool definitions this version of the package serves yet.)",
      "link": "https://verifymcp.io/servers/bpmnkit-bpmnkit/bpmnkit-cli#chg-chg_01a118df-9dd1-7c8c-a896-891cb53ac38d"
    },
    {
      "id": "chg_01a118df-9e32-798c-9b44-b4b8d0cc9dac",
      "kind": "check.reason",
      "family": "stability",
      "subject_kind": "check",
      "subject": "stability",
      "subject_child": "",
      "from_code": "stability.sandbox_failed",
      "to_code": "stability.sandbox_pending",
      "from_value": "unverified",
      "to_value": "unverified",
      "materiality": "security",
      "direction": "neutral",
      "score_delta": null,
      "detail": {
        "reason": "version_superseded"
      },
      "occurred_on": "2026-10-08",
      "occurred_at": "2026-10-08 00:17:48.345691+00",
      "observed_since": "2026-10-04",
      "source": "scan",
      "summary": "Stability (Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet.)",
      "link": "https://verifymcp.io/servers/bpmnkit-bpmnkit/bpmnkit-cli#chg-chg_01a118df-9e32-798c-9b44-b4b8d0cc9dac"
    },
    {
      "id": "chg_01a0faeb-ed5b-79b1-965f-cbbb887cafcd",
      "kind": "check.reverified",
      "family": "supplychain-malware",
      "subject_kind": "check",
      "subject": "supplychain-malware",
      "subject_child": "",
      "from_code": "supplychain.malware_inconclusive",
      "to_code": "supplychain.malware_clean",
      "from_value": "unverified",
      "to_value": "pass",
      "materiality": "security",
      "direction": "improvement",
      "score_delta": null,
      "detail": {},
      "occurred_on": "2026-10-02",
      "occurred_at": "2026-10-02 04:42:40.74205+00",
      "observed_since": "2026-10-01",
      "source": "scan",
      "summary": "Malware scan (unverified → pass)",
      "link": "https://verifymcp.io/servers/bpmnkit-bpmnkit/bpmnkit-cli#chg-chg_01a0faeb-ed5b-79b1-965f-cbbb887cafcd"
    },
    {
      "id": "chg_01a0f8cd-f668-7ce4-aac3-2909d02e0a09",
      "kind": "check.unverifiable",
      "family": "supplychain-malware",
      "subject_kind": "check",
      "subject": "supplychain-malware",
      "subject_child": "",
      "from_code": "supplychain.malware_clean",
      "to_code": "supplychain.malware_inconclusive",
      "from_value": "pass",
      "to_value": "unverified",
      "materiality": "security",
      "direction": "regression",
      "score_delta": null,
      "detail": {
        "reason": "vendor_not_cached"
      },
      "occurred_on": "2026-10-01",
      "occurred_at": "2026-10-01 18:50:42.42298+00",
      "observed_since": "2026-09-30",
      "source": "scan",
      "summary": "Malware scan (pass → unverified)",
      "link": "https://verifymcp.io/servers/bpmnkit-bpmnkit/bpmnkit-cli#chg-chg_01a0f8cd-f668-7ce4-aac3-2909d02e0a09"
    },
    {
      "id": "chg_01a0f09e-e6bc-7644-ab97-dee071cf4954",
      "kind": "advisory.identified",
      "family": "vulnerabilities",
      "subject_kind": "advisory",
      "subject": "CVE-2026-100700",
      "subject_child": "",
      "from_code": null,
      "to_code": "cve.transitive",
      "from_value": null,
      "to_value": "high",
      "materiality": "security",
      "direction": "regression",
      "score_delta": null,
      "detail": {
        "id": "CVE-2026-100700",
        "severity": "high"
      },
      "occurred_on": "2026-09-30",
      "occurred_at": "2026-09-30 04:42:20.687916+00",
      "observed_since": "2026-09-29",
      "source": "scan",
      "summary": "CVE-2026-100700 affects this package (high)",
      "link": "https://verifymcp.io/servers/bpmnkit-bpmnkit/bpmnkit-cli#chg-chg_01a0f09e-e6bc-7644-ab97-dee071cf4954"
    },
    {
      "id": "chg_01a0f09e-e6bc-7d40-b92b-75f773ccc457",
      "kind": "advisory.identified",
      "family": "vulnerabilities",
      "subject_kind": "advisory",
      "subject": "CVE-2026-100702",
      "subject_child": "",
      "from_code": null,
      "to_code": "cve.transitive",
      "from_value": null,
      "to_value": "high",
      "materiality": "security",
      "direction": "regression",
      "score_delta": null,
      "detail": {
        "id": "CVE-2026-100702",
        "severity": "high"
      },
      "occurred_on": "2026-09-30",
      "occurred_at": "2026-09-30 04:42:20.687916+00",
      "observed_since": "2026-09-29",
      "source": "scan",
      "summary": "CVE-2026-100702 affects this package (high)",
      "link": "https://verifymcp.io/servers/bpmnkit-bpmnkit/bpmnkit-cli#chg-chg_01a0f09e-e6bc-7d40-b92b-75f773ccc457"
    },
    {
      "id": "chg_01a0f09e-e6bf-741c-a4e1-be5edfa7c962",
      "kind": "check.reverified",
      "family": "supplychain-malware",
      "subject_kind": "check",
      "subject": "supplychain-malware",
      "subject_child": "",
      "from_code": "supplychain.malware_inconclusive",
      "to_code": "supplychain.malware_clean",
      "from_value": "unverified",
      "to_value": "pass",
      "materiality": "security",
      "direction": "improvement",
      "score_delta": null,
      "detail": {},
      "occurred_on": "2026-09-30",
      "occurred_at": "2026-09-30 04:42:20.687916+00",
      "observed_since": "2026-09-29",
      "source": "scan",
      "summary": "Malware scan (unverified → pass)",
      "link": "https://verifymcp.io/servers/bpmnkit-bpmnkit/bpmnkit-cli#chg-chg_01a0f09e-e6bf-741c-a4e1-be5edfa7c962"
    }
  ],
  "days": [
    {
      "date": "2026-11-04",
      "total": 47,
      "delta": 0,
      "tracked": true,
      "explained": true,
      "beyond_event_horizon": false,
      "attribution": null,
      "event_count": 7
    },
    {
      "date": "2026-11-03",
      "total": 47,
      "delta": 0,
      "tracked": true,
      "explained": true,
      "beyond_event_horizon": false,
      "attribution": null,
      "event_count": 1
    },
    {
      "date": "2026-10-28",
      "total": 47,
      "delta": 0,
      "tracked": true,
      "explained": true,
      "beyond_event_horizon": false,
      "attribution": null,
      "event_count": 3
    },
    {
      "date": "2026-10-24",
      "total": 47,
      "delta": 0,
      "tracked": true,
      "explained": true,
      "beyond_event_horizon": false,
      "attribution": null,
      "event_count": 3
    },
    {
      "date": "2026-10-23",
      "total": 47,
      "delta": 0,
      "tracked": true,
      "explained": true,
      "beyond_event_horizon": false,
      "attribution": null,
      "event_count": 1
    },
    {
      "date": "2026-10-20",
      "total": 47,
      "delta": 0,
      "tracked": true,
      "explained": true,
      "beyond_event_horizon": false,
      "attribution": null,
      "event_count": 1
    },
    {
      "date": "2026-10-14",
      "total": 47,
      "delta": 0,
      "tracked": true,
      "explained": true,
      "beyond_event_horizon": false,
      "attribution": null,
      "event_count": 5
    },
    {
      "date": "2026-10-09",
      "total": 47,
      "delta": 0,
      "tracked": true,
      "explained": true,
      "beyond_event_horizon": false,
      "attribution": null,
      "event_count": 2
    }
  ]
}