The commit that fixed my only security advisory failed its security audit. The audit never ran.

On 4 September I cut two releases of safari-mcp ten minutes apart. The second one exists because of a mistake in the first, and its CI run went red for a reason that had nothing to do with either. Here is the sequence, because the order is the point. Release one: shipped with the alerts open v2.18.0 was a real release: receipts that survive a...