v1.0.0

⚠ BREAKING CHANGES

• release: nestro.includePreReleases now defaults to false, so update checks and the version picker only offer prerelease versions after you opt in.
• release: A new nestro.minimumReleaseAgeDays setting (default 7) holds back releases younger than seven days: update checks offer the newest eligible version instead, and the version picker marks a held-back version and asks for confirmation before it is applied. Set it to 0 to disable the hold-back.
• release: Update Package, Pick Version..., Switch to dev/dep, Toggle version pin, Remove Package, Open on npmjs.com, and Copy Package Name no longer appear in the Command Palette; run them from a package row in the Nestro view. Update All, Run Install, Search Packages, Run Security Audit, and Pin All Versions still appear in the Command Palette, but only while they can actually run.
• release: Clear Search Query no longer appears in the Command Palette either; it is now in the Nestro view's overflow menu and is shown only while a search is active.
• release: Open on npmjs.com, Switch to dev/dep, Toggle version pin, and Remove Package no longer have inline buttons on a package row; open the row's context menu instead, where Toggle version pin appears only for a dependency whose version spec Nestro can rewrite.
• release: Run Install and Settings are no longer buttons in the Nestro view title bar; both moved into the view's overflow menu, and Run Install is shown there only when it can actually run.
• release: Nestro now declares that it does not support virtual workspaces, so it no longer loads in a virtual workspace such as a Remote Repositories window. It still runs in Remote SSH, Dev Containers, and WSL, where its file access and package-manager processes execute on the remote or container side rather than on the local client.
• release: The search and filter rows were removed from the package tree in favor of status rows, detailed failure output moved to dedicated Output channels, and the Marketplace category "Programming Languages" was dropped, leaving "Other" as the extension's only category.

Features

• accessibility: describe package update states (68e0fe5)
• audit: expose structured advisory reports (b4d54b3)
• localization: add english message catalogs (4465ef9)
• remove obsolete skills and update project learnings (0915a4b)
• updates: enforce a release cooldown (78d1c44)
• workspaces: parallelize package project checks (f003255)

Bug Fixes

• audit: attribute npm audit v2 advisories to package rows (12e377d)
• audit: bound audit process execution (e1e35a7)
• audit: ignore stale audit completions (09a8ea8)
• audit: parse bun advisory results (8f9c376)
• audit: require recognized audit results (d177e01)
• audit: resolve canonical package projects (c4e5658)
• audit: support explicit yarn audit families (bd0324e)
• clients: validate package manager operands (30c4eb0)
• commands: correct command palette visibility (0e497ff)
• commands: validate current package identity (cf03f15)
• debug: point the launch configuration at the real bundle (7606245)
• dependencies: prevent switch target overwrites (61cd9c7)
• filters: reject unrecognized filter values (5e4f1b6)
• filters: unify visible package counts (028c2ec)
• install: treat a cancelled package root pick as a cancel (eab4dc9)
• logging: sanitize extension diagnostics (ea4411b)
• manifest: declare workspace capabilities (65e225e)
• operations: serialize package project mutations (5956d1e)
• packaging: enforce the vsix content allowlist (158e011)
• picker: format the held-back date (95f68b1)
• pinning: make pin all atomic (125a2a7)
• pinning: preserve dependency spec semantics (0665a7e)
• provider: ignore stale package loads (8061ec2)
• registry: honor bun project configuration (f50ffbe)
• registry: honor npm project configuration (6ce57f8)
• registry: honor yarn project configuration (ef67ef7)
• release: add missing release rules for refactor and style types [skip ci] (a988079)
• release: align analyzed release types (eec0afb)
• test: terminate tasks through the started execution (206af74)
• ui: describe the running operation on a busy row (e970548)
• ui: enable global actions only where they can run (24af9c3)
• ui: move detailed failures to output (a826111)
• ui: show the active filter and search in the tree (c9aee8e)
• updates: make prerelease updates opt in (f4f85f0)
• updates: reject stale update results (3206b24)
• workspaces: disambiguate package root labels (f1d217f)

Maintenance

• branding: replace the marketplace icon (59fb6c3)
• deps: patch brace expansion tooling (034d3dd)
• deps: patch drifted tooling advisories (ad66b06)
• deps: patch drifted tooling advisories (b194e2b)
• deps: patch redrifted tooling advisories (e938d96)
• deps: patch release tooling advisories (6f6b8d5)
• deps: patch vite tooling advisories (6595acc)
• deps: remove the unused script runner (51a6051)
• lint: make validation non-mutating (7defa20)
• marketplace: complete extension metadata (7c51a8c)
• modules: enforce selective barrel exports (f72f19c)
• package: rebaseline the vsix size budget (1bc22a0)
• packages: separate transforms from file access (8146af7)
• package: update (e4a4d1d)
• pnpm: drop the stale script hook setting (88db29b)
• pnpm: enable package signature verification (e715f3e)
• provider: extract audit orchestration (ce057b8)
• provider: extract package loading (e2e9e98)
• provider: extract update orchestration (e9e81bf)
• provider: extract view projection (e1ce2d0)
• registry: add metadata adapter contracts (e2e4c40)
• release: declare the 1.0 stable baseline (1ac1783)
• tests: shorten coverage threshold comments (66b8aee)
• types: align node types with the extension host (d01ca1b)
• ui: remove search and filter rows (cc3b07b)
• ui: simplify package row actions (f40717f)
• ui: simplify package view toolbar (f575e36)