
Security News
GPT-6 Astra Attempts Supply Chain Attacks Against Open Source Maintainers in Testing
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.
@getbourdon/conformance
Advanced tools
Language-neutral cross-implementation parity fixtures for Bourdon. Python (pip install bourdon) is the oracle; the @getbourdon/* TypeScript mirror asserts against these exact bytes.
Language-neutral cross-implementation parity fixtures for Bourdon.
Python (pip install bourdon) is the oracle. The @getbourdon/* TypeScript mirror is conformant iff it
reproduces the oracle's output on these exact fixtures — byte-for-byte where the contract is bytes (redaction,
recognition strings, MCP wire), value-for-value where it's structured (F1, schema validity, tool I/O).
The fixtures are generated by the Python repo's tools/gen_conformance.py (the single writer) and consumed by
both the Python test suite and the TS vitest suite. This package ships them with typed loaders.
import { loadRedactionBattery, assembleSecret } from "@getbourdon/conformance";
const battery = loadRedactionBattery();
for (const secret of battery.secrets) {
// a faithful TS redaction port must produce battery's expected output:
expect(redactText(assembleSecret(secret))).toBe(secret.expect_redacted);
}
Resolution (Phase 0–1): BOURDON_CONFORMANCE_DIR, else the sibling Python checkout
../bourdon/conformance. Once published, the fixtures ship inside this package.
License: Apache-2.0 (the wire-contract surface is permissive so third parties can build conformant implementations). The Bourdon engine is BUSL-1.1.
FAQs
Language-neutral cross-implementation parity fixtures for Bourdon. Python (pip install bourdon) is the oracle; the @getbourdon/* TypeScript mirror asserts against these exact bytes.
The npm package @getbourdon/conformance receives a total of 58 weekly downloads. As such, @getbourdon/conformance popularity was classified as not popular.
We found that @getbourdon/conformance demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.

Product
Socket can now send alerts and supply chain attack notifications to Microsoft Teams, with filters that route the right updates to each channel.

Security News
pnpm 12 rewrites the package manager in Rust, cutting install times by up to 90% while preserving pnpm 11 workflows and lockfiles.