feat: add asset scanning support in import

…flow

…Each

Assets loaded from --data-dir backup may not have a publish_details field
if they were never published. The optional chain only guarded `asset`,
not `publish_details`, causing a TypeError in displayAssetsDetails().

…sets.js

setConfig() assigned to `config` at module scope but the variable was
never declared, causing a ReferenceError on any cm:assets:publish run
that goes through the data-dir flow.

…portCommand for asset publishing

…nd update related logic

fix: Update flags in AssetsPublishCommand and add user reminder in ImportCommand for asset publishing

publish() flattened each asset's publish_details into independent
environments[] and locales[] arrays, so the CMA republished the cartesian
product. For a ragged publish state (different locales on different
environments) this over-published to env-locale pairs that never existed
on the source stack.

Add buildPublishGroups: group publish_details by environment, coalesce
environments with an identical locale set, and emit one publish call per
group so each call is a single rectangle the CMA reproduces exactly. A
rectangular asset still collapses to one call (unchanged behavior). The
DX-1656 invalid-environment guard is preserved (envs absent from the
destination are still skipped).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Bumps [adm-zip](https://github.com/cthackers/adm-zip) from 0.5.18 to 0.6.0.
- [Release notes](https://github.com/cthackers/adm-zip/releases)
- [Changelog](https://github.com/cthackers/adm-zip/blob/master/history.md)
- [Commits](cthackers/adm-zip@v0.5.18...v0.6.0)

---
updated-dependencies:
- dependency-name: adm-zip
  dependency-version: 0.6.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

back merge

git-diff@2.0.7 is unmaintained (last published 2018) and pulls in
chalk@2, diff@3, loglevel, shelljs and shelljs.exec. Snyk flagged the
only vulnerable path in the monorepo through that tree:

  Missing Release of Resource after Effective Lifetime [Medium]
  SNYK-JS-INFLIGHT-6095116
  git-diff@2.0.7 > shelljs@0.8.5 > glob@7.2.3 > inflight@1.0.6

Snyk reports no direct upgrade or patch, since git-diff is abandoned.

Replace it with diff@^9 (jsdiff): zero runtime dependencies, bundled
TypeScript types, dual CJS/ESM. It also removes the dependency on a
`git` binary and the temp-file/subprocess round trip git-diff used to
shell out through shelljs.

buildDiffString now calls createTwoFilesPatch, which emits the `---`
and `+++` file headers itself, so the hand-rolled header concatenation
is gone. Output was verified equivalent: both patch strings were run
through Diff2html.parse and compared on file names, added/deleted line
counts, hunk headers and every line type plus content - identical.

Identical inputs are also handled better. git-diff returned undefined
when both sides matched, which interpolated the literal string
"undefined" into the patch; createTwoFilesPatch returns a well-formed
patch with no hunks.

Drop @types/git-diff, since diff ships its own types.

Tests: the existing spec mocked diff2html, so the generated patch was
never asserted. Add two cases covering the string handed to
Diff2html.parse - one for headers, hunk and changed lines, one for the
identical-input case. Both were mutation-checked against a corrupted
buildDiffString.

Suite: 78 passed, 16 suites, tsc clean, Snyk reports no vulnerable
paths across the monorepo.

Bump the pinned pnpm-lock.yaml checksum in .talismanrc, which the
lockfile change invalidates. The finding is the usual sha512 integrity
hashes, not a secret.

Note: this commit also carries a pre-existing, uncommitted version bump
to 1.5.4 that was already present in package.json.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

added audit check and fix for assets in pending or quarantined state

feat: v1 asset scanning support in bulk publish and import

…ull-guard

fix(bulk-publish): add null guard on asset.publish_details before forEach

…-zip-0.6.0

chore(deps): bump adm-zip from 0.5.18 to 0.6.0

bumped versions

…o updated-lock-file

…ns into updated-lock-file

updated lock file

Development