aryamthecodebreaker · aryamthecodebreaker · Aug 2, 2026 · Aug 2, 2026
diff --git a/.gitignore b/.gitignore
@@ -19,3 +19,5 @@ fixmap-report.md
 
 # Local design-QA scratch: references machine-specific temp paths.
 design-qa.md
+
+.vercel
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -6,6 +6,32 @@ Accuracy figures inside a released entry are the numbers measured **at that rele
 left as written. The current numbers live on the [evidence page](https://usefixmap.vercel.app/evidence),
 which is generated from the recorded results rather than transcribed by hand.
 
+## 0.8.7 - 2026-08-02
+
+### Fixed
+
+- A pretty-printed vendored dependency bundle could rank first at high confidence. It escaped content-based bundle detection — 96 characters per line against a 400-character threshold, and one bundler marker against a threshold of two — and it escaped generated-duplicate filtering, which by design only drops a generated path that has a maintained source twin. A vendored dependency has none, so it fell through both. Detection now accepts a single marker when the path is itself conventional generated output, such as a `compiled/` segment (#446).
+
+### Evidence
+
+- Added a pretty-printed vendored-bundle case to the adversarial suite, which was previously all minified fixtures. The suite is 9/9 with a false-confidence rate of 0.0.
+- Chalk's `source/vendor/supports-color/index.js` still ranks first for a colour-detection task. It is a vendored path whose content genuinely is the only implementation of the behavior, and it is the counterexample any path-based rule has to keep passing.
+- Held-out remains 7/12 Top-1, 8/12 Top-3, 9/12 Top-5; external remains 11/16, 16/16, 16/16.
+
+### Note on the gap after 0.8.6
+
+The fix above was merged to `main` before this release, and for a short window the published changelog described it as shipped while npm still served 0.8.6 without it. That is the #274 defect with its polarity reversed: the site advertising a fix the released artifact lacks, rather than an accuracy figure it no longer achieves. The website changelog no longer has an unreleased state — every entry on it is a version you can install.
+
+### Installation
+
+```bash
+npm install --global @aryam/fixmap@0.8.7
+fixmap doctor
+fixmap chalk/chalk#624
+```
+
+The npm packages, MCP Registry entry, GitHub tag/release, Action tag, and production site must all resolve to 0.8.7 before the release is considered complete.
+
 ## 0.8.6 - 2026-08-02
 
 ### Fixed

diff --git a/README.md b/README.md
@@ -79,7 +79,7 @@ Doctor 0.8.4 and newer compares an exact npm-requested version when that newer D
 
 ```powershell
 $fixmapPrefix = Join-Path $env:TEMP "fixmap-cli-0.8.6"
-npm install --global --prefix $fixmapPrefix @aryam/fixmap@0.8.6
+npm install --global --prefix $fixmapPrefix @aryam/fixmap@0.8.7
 & "$fixmapPrefix\fixmap.cmd" --version
 ```
 
@@ -367,7 +367,7 @@ jobs:
         with:
           fetch-depth: 0
       - id: fixmap
-        uses: aryamthecodebreaker/FixMap@v0.8.6
+        uses: aryamthecodebreaker/FixMap@v0.8.7
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
 ```
@@ -378,7 +378,7 @@ To close the plan→edit→verify loop without leaving GitHub, save the plan as
 
 ```yaml
       - id: plan
-        uses: aryamthecodebreaker/FixMap@v0.8.6
+        uses: aryamthecodebreaker/FixMap@v0.8.7
         with:
           format: json
       - run: echo '${{ steps.plan.outputs.report }}' > fixmap-plan.json
@@ -388,7 +388,7 @@ To close the plan→edit→verify loop without leaving GitHub, save the plan as
           path: fixmap-plan.json
 
       # In a later run, after the fix is pushed:
-      - uses: aryamthecodebreaker/FixMap@v0.8.6
+      - uses: aryamthecodebreaker/FixMap@v0.8.7
         with:
           mode: verify
           report-path: fixmap-plan.json

diff --git a/apps/web/app/changelog/page.tsx b/apps/web/app/changelog/page.tsx
@@ -21,7 +21,15 @@ type ChangeGroup = {
   items: string[];
 };
 
+/**
+ * Every entry here is a version that is published and installable. There is deliberately no
+ * "unreleased" or "coming next" state: an entry describing work that has only landed on main
+ * tells a reader a fix is available when `npm install` will not give it to them. That is the
+ * defect behind #274 pointed the other way — and it happened here once already, with the
+ * vendored-bundle fix listed as shipped while npm still served the version without it.
+ */
 type Release = {
+  /** A published semver version. Never "Unreleased". */
   version: string;
   date: string;
   label?: string;
@@ -31,10 +39,10 @@ type Release = {
 
 const releases: Release[] = [
   {
-    version: "Unreleased",
-    date: "Pending release",
-    label: "In progress",
-    summary: "Improvements that are tested and ready for the next package release.",
+    version: "0.8.7",
+    date: "August 2, 2026",
+    label: "Latest release",
+    summary: "Readable vendored dependency bundles stop posing as edit targets.",
     groups: [
       {
         label: "Fixed",
@@ -54,7 +62,6 @@ const releases: Release[] = [
   {
     version: "0.8.6",
     date: "August 2, 2026",
-    label: "Latest release",
     summary: "Cleaner implementation rankings without hiding legitimate UI or generated-artifact work.",
     groups: [
       {
@@ -214,7 +221,7 @@ export default function ChangelogPage() {
           <nav>
             {releases.map((release) => (
               <a key={release.version} href={`#${releaseId(release.version)}`}>
-                <span>{release.version === "Unreleased" ? "Next" : `v${release.version}`}</span>
+                <span>v{release.version}</span>
                 <small>{release.date}</small>
               </a>
             ))}
@@ -227,7 +234,7 @@ export default function ChangelogPage() {
               <header className="release-heading">
                 <div>
                   <p>{release.date}</p>
-                  <h2>{release.version === "Unreleased" ? "Coming next" : `FixMap v${release.version}`}</h2>
+                  <h2>FixMap v{release.version}</h2>
                 </div>
                 {release.label ? <span>{release.label}</span> : null}
               </header>

diff --git a/apps/web/package.json b/apps/web/package.json
@@ -15,7 +15,7 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@aryam/fixmap-core": "0.8.6",
+    "@aryam/fixmap-core": "0.8.7",
     "@phosphor-icons/react": "^2.1.10",
     "next": "16.2.11",
     "react": "19.2.7",

diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "fixmap-workspace",
-  "version": "0.8.6",
+  "version": "0.8.7",
   "private": true,
   "description": "Local-first repo context for coding agents: paste a GitHub issue URL to get ranked files, test routes, and risks.",
   "license": "MIT",

diff --git a/packages/action/package.json b/packages/action/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@fixmap/action",
-  "version": "0.8.6",
+  "version": "0.8.7",
   "description": "GitHub Action wrapper for FixMap pull request reports.",
   "private": true,
   "license": "MIT",
@@ -11,6 +11,6 @@
     "typecheck": "tsc -p tsconfig.json --noEmit"
   },
   "dependencies": {
-    "@aryam/fixmap-core": "0.8.6"
+    "@aryam/fixmap-core": "0.8.7"
   }
 }
diff --git a/packages/cli/package.json b/packages/cli/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aryam/fixmap",
-  "version": "0.8.6",
+  "version": "0.8.7",
   "mcpName": "io.github.aryamthecodebreaker/fixmap",
   "description": "Local-first CLI and MCP server mapping GitHub issue URLs, tasks, and diffs to ranked files, tests, and risks.",
   "license": "MIT",
@@ -46,7 +46,7 @@
     "typecheck": "tsc -p tsconfig.json --noEmit"
   },
   "dependencies": {
-    "@aryam/fixmap-core": "0.8.6",
+    "@aryam/fixmap-core": "0.8.7",
     "@modelcontextprotocol/sdk": "1.30.0"
   },
   "engines": {

diff --git a/packages/core/package.json b/packages/core/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aryam/fixmap-core",
-  "version": "0.8.6",
+  "version": "0.8.7",
   "description": "Deterministic local-first repository scanner, context ranker, and report renderer for coding agents.",
   "license": "MIT",
   "repository": {

diff --git a/server.json b/server.json
@@ -6,12 +6,12 @@
     "url": "https://github.com/aryamthecodebreaker/FixMap",
     "source": "github"
   },
-  "version": "0.8.6",
+  "version": "0.8.7",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@aryam/fixmap",
-      "version": "0.8.6",
+      "version": "0.8.7",
       "transport": {
         "type": "stdio"
       },
Original file line number	Diff line number	Diff line change
Expand Up		@@ -19,3 +19,5 @@ fixmap-report.md

		# Local design-QA scratch: references machine-specific temp paths.
		design-qa.md

		.vercel