Skip to content

Chameleon

v2.38.28 Breaking

This release includes breaking changes for platform teams planning a safe upgrade.

✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

ai-coding-assistant archetype ast-analysis claude-code claude-plugin code-conventions
+12 more
code-review code-style developer-tools javascript linter mcp mcp-server prompt-engineering python ruby rails typescript

Affected surfaces

breaking_upgrade

Summary

AI summary

Fixed Alembic migration detection and Prisma schema change nudging, corrected Redux slice over‑matching, improved coordinator monorepo onboarding.

Full changelog

Whole-plugin QA across every supported framework (Rails, Django, DRF, Flask,
FastAPI, Next.js, NestJS) and the standalone components (daemon, MCP stdio,
statusline, merge driver). Framework detection, framework-aware guidance,
bootstrap, and the enforcement/hook stack all verified correct on the released
build; the co-change advisory rules had three framework gaps, now fixed.

Fixed

  • Alembic migrations weren't recognized by the model-migration co-change rule.
    _is_django_migration matched only /migrations/, so on any FastAPI/SQLAlchemy
    repo (Alembic's standard alembic/versions/ layout) the rule silently
    auto-disabled and a new model without a migration was never nudged — despite the
    message advertising "SQLAlchemy: add the Alembic revision". Now mirrors the
    archetype layer's alembic-aware classifier.
  • cochange-prisma-migration could never fire. A .prisma file resolves to
    language None and was skipped before rule matching; the 8-file trigger floor
    also disabled it (Prisma repos have one schema.prisma); and the schema change
    is an edit, not a new file. Now recognizes .prisma as a TS-ecosystem artifact,
    supports a per-rule trigger floor (1 for Prisma), and fires opt-in rules on an
    edit — so editing schema.prisma without a migration is nudged.
  • _is_redux_slice over-matched. 'slice' in name false-fired
    cochange-slice-store on imageSlicer.ts / pizzaSlices.ts / backslice.ts;
    tightened to the Redux Toolkit fooSlice.ts convention (capital-S suffix token).
  • Coordinator-monorepo onboarding. A pnpm/turbo/nx root with no first-class
    source bootstraps its workspaces but writes no root profile
    (status: "success_workspaces_only"), so /chameleon-trust at the root failed
    with a contradictory "run /chameleon-init first". trust_profile now detects a
    coordinator root and points the user at the bootstrapped workspaces, and the
    init skill documents the per-workspace trust flow and the coordinator-root
    turn-end limitation.

Known limitations (scoped follow-ups)

  • The turn-end Stop safety net does not run for a pure-coordinator monorepo root
    (Claude Code's cwd is the profile-less root); per-edit guidance still works.
  • A cross-workspace existence break (a removed export imported only across a
    workspace boundary) is not flagged, because per-workspace reverse indexes don't
    record sibling-workspace importers.

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track Chameleon

Get notified when new releases ship.

Sign up free

About Chameleon

All releases →

Related context

Earlier breaking changes

  • v3.0.0 MCP surface folded from 48 tools to 19; remaining 32 operator tools become actions on three dispatchers.

Beta — feedback welcome: [email protected]