Prepare v0.4.0 release

CHANGELOG.md

@@ -2,9 +2,13 @@
 
 ## Unreleased
 
+## 0.4.0
+
 - Add offline scope evidence for classic `products/update` and `orders/create` subscriptions in `shopify.app.toml`, with separate EVIDENCED, NOT EVIDENCED, and UNKNOWN results from Shopify Events.
 - Expose classic webhook evidence counts in human, JSON, SARIF, and GitHub Action outputs without including destinations or filter values.
-- Require Node.js 22 or newer for the CLI, test Node.js 22 and 24 in CI, and update GraphQL.js to 17.0.2. This drops Node.js 20 CLI support.
+- Upgrade GraphQL.js to 17.0.2.
+- Breaking: require Node.js 22 or newer for the CLI; Node.js 20 is no longer supported. The Action remains on Node.js 24; CI tests Node.js 22 and 24 plus the required Node.js 20 check.
+- Map `write_marketplace_orders` to its implied marketplace read scope for `orders/create`, while preserving UNKNOWN results and optional-scope uncertainty.
 - Correct the standalone GraphQL document support note and refresh the immutable Action example to the v0.3.0 commit.
 
 ## 0.3.0

dist/index.cjs

@@ -2034,7 +2034,7 @@ var import_node_path3 = __toESM(require("node:path"), 1);
 var import_node_crypto = require("node:crypto");
 
 // src/version.js
-var TOOL_VERSION = "0.3.0";
+var TOOL_VERSION = "0.4.0";
 
 // src/analyzer/index.js
 var import_node_fs2 = __toESM(require("node:fs"), 1);

package.json

@@ -1,6 +1,6 @@
 {
   "name": "shopify-scope-guard",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Review Shopify app OAuth and API access scopes against static repository evidence with a CLI and GitHub Action.",
   "type": "module",
   "bin": {

src/version.js

@@ -1,2 +1,2 @@
 // Generated from package.json.
-export const TOOL_VERSION = "0.3.0";
+export const TOOL_VERSION = "0.4.0";