geohash-kit v1.6.1

Bug Fixes

• publish a uniquely versioned canonical artefact containing the existing prototype-pollution hardening, replacing a stale third-party snapshot that incorrectly claimed version 1.6.0

---

Reproducible build: byte-identical output verified across two independent CI runners.

Artefact integrity

file:      geohash-kit-1.6.1.tgz
size:      30458 bytes
sha256:    9182720fff88ccc370bdc05088b031a41dcbf59c296e310634dd7f2fd2820676
sha512-0cXQhsdPV84AyicOHIvmwTDDpvve4HMthM2wj1XImFvqIR4wLMqGUJdg7oHjV91Fpt3EDlUvURvol6vemWoX4w==

Verify against the registry tarball:

curl -sLO https://registry.npmjs.org/geohash-kit/-/geohash-kit-1.6.1.tgz
shasum -a 256 geohash-kit-1.6.1.tgz

v1.6.0

Changed

• migrate release tooling from semantic-release to forgesworn/release-action. Removes hundreds of transitive devDependencies, hardens the pre-publish path with gated secret scanning, exports-map verification, frozen-vector gating, and runtime-only npm audit, and replaces the workflow-env NPM_CONFIG_PROVENANCE=true pattern (fragile on npm 11.6+) with publishConfig.provenance: true in package.json. No runtime or API changes for consumers.

Why

semantic-release's bundled npm CLI brings chronic Dependabot noise that does not affect published artefacts, and its transitive devDependency graph is large enough to conflict with the supply-chain posture a cryptography-adjacent library should hold itself to. The replacement is a pure-bash release tool with hard pre-publish gates. The existing frozen-vector check (npm run vectors:check) is now a release-blocking gate rather than a CI-only check — a drift in encoded output will refuse the publish until either the vectors or the implementation are explicitly updated.

geohash-kit is the second consumer of forgesworn/release-action after nsec-tree@1.5.0. This migration validates that the pattern generalises beyond a single library.

Artefact integrity

file:      geohash-kit-1.6.0.tgz
size:      30374 bytes
sha256:    ce02d07ccbc25a1a3a000e59b093e9c9e5bc61dea31b1c4f496ba238935f51b1
sha512-ksdw2ahCaJVTLYpCYS7RFq316BWSOiHxiWTGJewSNza9sdy9gepWJxVxNzgc/AgQtvxLDPyf30x0lbfHKMZRAg==

Verify against the registry tarball:

curl -sLO https://registry.npmjs.org/geohash-kit/-/geohash-kit-1.6.0.tgz
shasum -a 256 geohash-kit-1.6.0.tgz

v1.5.3

1.5.3 (2026-03-20)

Bug Fixes

• correct copyright to TheCryptoDonkey (8c18561)

v1.5.2

1.5.2 (2026-03-18)

Bug Fixes

• repair broken tags and update CHANGELOG URLs after org transfer (aeab662)

v1.5.1

1.5.1 (2026-03-12)

Bug Fixes

• harden against prototype pollution, add input validation, cap ring expansion (5297db9)
• validate geohash input in createGTagFilterFromGeohashes (844329a)

v1.5.0

1.5.0 (2026-03-09)

Features

• add android compatibility vectors and CI check (fe6a015)

v1.4.2

1.4.2 (2026-03-06)

Bug Fixes

• deduplicate BASE32, tighten tests, update AI discoverability (d21366b)

v1.4.1

1.4.1 (2026-03-05)

Bug Fixes

• normalise repository URL in package.json (a1ebe66)

v1.4.0

1.4.0 (2026-03-05)

Features

• extract convexHull(points) coordinate-based primitive (96b4179)

v1.3.0

1.3.0 (2026-02-27)

Features

• add circleToPolygon and getDestinationPoint for geodesic circle approximation (952fe79)