Depdiff v0.1.0 is the first public release of the static, local-first npm update risk auditor.
Highlights:
- File-and-line evidence for package changes without executing target package code
- Policy gates for CI and GitHub Actions
- SARIF, JSON, Markdown, and standalone HTML reports
- Cross-platform archive and directory comparison
- Reproducible precision corpus with pinned provenance
The attached npm tarball is the exact artifact verified and published by the release workflow. npm provenance is available from the registry.