v1.12.0

1.12.0 - 2026-07-21

• Resolved exact Maven Central parent and imported-BOM POMs when a filesystem
  scan or ci input needs external dependencyManagement versions. Model
  resolution is identity-checked, cached, offline-capable, limited to 32 remote
  POMs of at most 2 MiB each and eight parent/BOM levels, and remains fail-closed
  when the complete model cannot be proven.

• Preserved standard Fetch Response fields while normalizing manually handled
  redirects, so injected or adapter-provided Fetch responses retain their status,
  headers, body, and cache metadata.

• Used package license declarations embedded in composer.lock as local
  evidence. Composer repository scans no longer report every package as
  unknown merely because vendor/ is absent and remote Packagist evidence is
  intentionally unavailable.

• Skipped unresolved vcpkg.json manifests and unpinned Conda environment
  files during repository-wide automatic discovery while preserving strict
  validation for explicit --lockfile selection. Partial native or
  environment manifests no longer abort concrete sibling dependency projects.

• Rendered structured error-detail arrays as JSON values instead of JavaScript
  object coercions such as [object Object], including missing Maven
  parent/BOM diagnostics.