Hyena Dart v2.0.1

Security and reliability fixes

• Escape source-controlled paths and symbol names in Markdown reports to prevent report markup injection.
• Reject extra CLI target paths and empty combined analyses instead of silently ignoring them.
• Report expected CLI usage, configuration, analysis, and filesystem failures without unhandled stack traces.
• Pin GitHub Actions and the pub.dev publishing workflow to reviewed commits.
• Verify the Dart SDK download used by orb setup and run package validation in the release workflow.

Documentation and maintenance

• Clarify MCP filesystem boundaries and Dart 3.12 private-named-parameter compatibility.
• Add contributor and private vulnerability-reporting guidance.
• Add redaction reminders to issue templates and correct benchmark artifact wording.
• Refresh compatible locked dependencies and use project-relative paths in the package example.

Hyena Dart v2.0.0

Breaking changes

• Hyena is now designed to run as a project-local development dependency:

  dart pub add dev:hyena_dart
  dart run hyena_dart analyze .

  Global executable mappings have been removed.
• Public unused declarations are now reported by default. Package authors can preserve exported APIs with --ignore-exports or ignore_exports: true.
• Console, JSON, Markdown, and HTML reports now use project/workspace-relative paths, making reports portable across machines. Existing baselines remain compatible.

Added

• analyze --ignore-exports
• analyze --ignore-private
• Project-local MCP invocation: dart run hyena_dart:hyena_mcp --root .

See the v1 to v2 migration guide for installation and command changes.

Hyena Dart v1.2.4

Fixed

• Apply Dart analyzer context boundaries to complexity source discovery, preventing nested SDKs and tool-managed checkouts from being parsed as project source.
• Normalize complexity target and discovered file paths before context checks.
• Preserve explicit analysis of projects located under tool-named paths; no .fvm-specific exclusion was added.

Verification

• Reproduced the v1.2.3 .fvm/flutter_sdk/packages/flutter/test_fixes/services/services.dart failure before the fix and confirmed it passes afterward.
• 105 tests passed locally and on Ubuntu, macOS, and Windows.
• Lower-bound dependency analysis and the exact reproduction passed.
• dart pub publish --dry-run completed with zero warnings.

Hyena Dart v1.2.3

Fixed

• Normalize and absolutize analysis targets and discovered source paths before creating Dart analyzer contexts, including current-directory and trailing-separator inputs.
• Resolve only files that belong to the selected Dart analyzer context, preventing nested tool worktrees from crashing analysis without hard-coded tool-directory exclusions.

Verification

• 104 tests passed locally and on Ubuntu, macOS, and Windows.
• Lower-bound dependency analysis and CLI smoke tests passed.
• dart pub publish --dry-run completed with zero warnings.

Hyena Dart 1.2.2

Highlights

• Parse modern Dart dot-shorthand syntax through analyzer 8.4 compatibility.
• Accept non-error dartdoc parser diagnostics while continuing to reject syntax errors.
• Exclude .dart_tool, build, and generated artifacts consistently.
• Preserve inherited field implementations and their initializer dependencies in dead-code reachability.
• Add deterministic single-package/workspace benchmarks, read-only external-repository mode, structured timing and RSS results, and a manually triggered GitHub Actions workflow.
• Reject performance comparisons when corpus metadata or correctness signatures differ, and reject external benchmark output paths inside the target or through symlink aliases.

Evidence from pinned public repositories

• Melos: both analyses across 110 files / 33,193 lines in a 7.53 s median; 66 dead-code candidates and 36 complexity violations.
• Flame: complexity across 1,625 files / 165,415 lines in a 1.46 s median; 190 threshold violations.
• Flutter packages: complexity across 3,514 files / 1.54 million lines in an 8.35 s median; 3,297 threshold violations.

The scans found concrete review leads in mature code, but findings remain triage inputs—not automatic refactoring instructions. See the tracked open-source benchmark report for methodology, pinned commits, examples, and caveats.

Known boundary

Resolved dead-code analysis of Dart 3.12 private named parameters still requires the larger analyzer 12 AST/element migration. Flame therefore has a valid complexity benchmark but no dead-code timing; failing sources were not silently excluded.

Verification

Independently verified at this exact commit on an 8-CPU large orb:

• Formatting and dart analyze --fatal-infos: passed.
• 101 tests: passed.
• dart pub publish --dry-run: 0 warnings, 41 KB archive.
• Full generated benchmark: 5 corpora, 2,705 Dart files, 14 cases, and 170 consistent action signatures.
• Supported lower dependency bounds and Dart 3.12 compatibility checks: passed.

Benchmark comparisons are advisory until repeated hosted-runner history establishes stable regression thresholds.

Hyena Dart 1.2.1

Highlights

• Correct cross-package dead-code reachability in Dart and Flutter workspaces.
• Preserve exact declaration identity across package boundaries without conflating same-named declarations or dead callers.
• Normalize native Windows workspace glob separators.
• Add realistic Flutter monorepo, malformed workspace, glob, and symlink regressions.
• Lock console, JSON, Markdown, HTML, and SARIF report compatibility with golden tests.

Verification

Validated on Linux, macOS, and Windows with the full test suite, static analysis, formatting checks, and supported lower dependency bounds.

Hyena Dart 1.2.0

What's new

• Analyze Dart workspaces and monorepos package by package, with explicit, nested, and supported glob member discovery.
• Apply nearest per-package configuration without double-counting nested package files.
• Produce package-scoped console, JSON, Markdown, and HTML reports with workspace-relative SARIF, baseline, and MCP findings.
• Configure framework and generated-code roots through dead_code.entry_points and entry_point_annotations.
• Preserve routes, serializers, dependency-injection registrations, plugin hooks, generated callbacks, and their reachable dependencies.
• Report consistent versions from hyena_dart --version and hyena_mcp --version, with CI and publishing drift checks.

See the README and changelog for workspace validation rules, matching behavior, and configuration examples.

Hyena Dart 1.1.2

What's new

• Add the globally activatable hyena_mcp stdio server with one workspace-confined, read-only hyena_analyze tool.
• Add bounded structured results, path and symlink confinement, resource limits, and a killable analysis timeout.
• Add a repository-local Agent Skill for cautious MCP and JSON CLI workflows.
• Polish the public package README and remove maintainer-only release setup.

The Agent Skill is repository tooling and is not included in the pub.dev archive. See the README and website documentation for MCP setup, limits, and the OS-sandbox boundary.

Hyena Dart 1.1.1

Fixed

• Correct the minimum analyzer constraint for the Element2 override APIs used by Hyena
• Correct the minimum glob constraint so lower-bound resolution runs on supported Dart SDKs

CI

• Validate minimum dependency resolution with fatal static analysis and an end-to-end CLI smoke test
• Continue running the full test suite across Linux, macOS, and Windows

Full changelog: v1.1.0...v1.1.1

Hyena Dart 1.1.0

Added

• Analyze individual Dart files as well as directories
• Detect unused explicit constructors
• Support source-level hyena:ignore suppressions for dead code and individual complexity rules
• Add versioned finding baselines with stable, line-independent fingerprints
• Add opt-in --fail-on exit codes for dead-code and complexity findings
• Add SARIF 2.1 output for code-scanning integrations

Fixed

• Preserve public APIs from directly importable package libraries and library parts
• Follow every conditional import and export branch
• Recognize inherited member implementations without requiring an @override annotation
• Conservatively retain unresolved dynamic member targets

Full changelog: v1.0.1...v1.1.0