[efegokdemir]

Summary

Prepare v0.5.0 with the target-aware UG-TAX-001 warning for configured tax_summaries/create subscriptions targeting API version 2027-01 or later.

Motivation

The rule is merged on main but is not in the published v0.4.0 npm package or Action. This minor release makes it available to consumers and updates the parser dependency to GraphQL 17.0.2.

Changes

• Set package and CLI versions to 0.5.0 and add matching release notes.
• Validate Shopify app TOML and match only an exact topic in an actual subscription topic array.
• Update the README, 2027-01 guide, Action example, and generated Action bundle.

Tests performed

• Node.js 22.23.4 and 24.22.1: clean dependency installs, 60/60 tests, coverage, lint, distribution check, dry-run package, package smoke, standalone Action smoke, and npm audit --audit-level=high all passed.
• Coverage: 97.27% statements/lines, 86.55% branches, 96.03% functions.
• Hosted pull-request checks are pending.

Compatibility

The CLI still requires Node.js 22 or newer; the Action runs on Node.js 24. Existing CLI and Action output contracts are unchanged apart from the new warning. GraphQL 17 is used internally by the parser.

Security and privacy

The scan remains offline. Malformed Shopify app TOML now fails with a path-only error; tests verify configuration values are not echoed. No credentials, telemetry, or Shopify network calls were added.

Shopify source/evidence

• 2027-01 tax Global ID change
• Introduction of tax_summaries/create
• Webhook subscription configuration
• 2027-01 release notes

Release impact

This is a v0.5.0 minor release for an additive consumer-facing rule. Publishing remains tag-triggered and will happen only after this PR is merged, the npm Trusted Publisher is verified, and the release workflow passes.

AI assistance was used to prepare the implementation and tests; the repository owner approved this release diff before publication.

Checklist

• The change is focused and the docs/examples match the implementation.
• Relevant regression tests and checks are recorded above.
• Generated distributions are up to date.
• No sensitive or third-party material was added without permission/licence review.