v0.15.0 — Trust the candidate direction

0.15.0 — Trust the candidate direction

Better compatibility alerts

• Only versions newer than the installed exact package are treated as upgrade candidates.
• npm latest dist-tag rollbacks no longer create false breaking-change incidents.
• A rollback does not clear an existing compatibility incident without evidence that the project changed.
• GitHub release notes are not fetched for equal or older candidates.

Consistent monitoring

• CLI radar check and radar watch now refresh generated DSH profile inventories before each poll, matching native DSH behavior.
• radar status remains a network-free snapshot; radar compare remains an explicit file comparison.

Validated with 87 tests, Node 22/24 CI, self-scan, deterministic and live DSH showcases, and a real DSH web profile where 11 false compatibility alerts became 0.

v0.14.0 — Follow the live DSH profile

0.14.0 — Follow the live DSH profile

Generated DSH overlays now record the selected profile and rebuild its installed dependency graph before every native polling cycle. This keeps always-on monitoring aligned with what DSH is actually running after plugin installs, upgrades, removals, and host-runtime changes.

Profile refresh is manifest-only and never imports or executes plugin code. If the profile cannot be read safely, the current cycle stops and the last durable state is preserved.

Validated with:

• 82 local tests
• GitHub Actions on Node 22 and Node 24
• self-scan
• headless DSH showcase
• live OSV/npm feeds with DSH delivery

v0.13.0 — dependency origin in alerts

Highlights

• Preserve whether an affected dependency came from the plugin profile or DSH's shared host runtime.
• Carry the origin into vulnerability events and durable DSH analysis tasks.
• Render Origin: plugin profile, Origin: DSH host runtime, or both in human alerts.
• Extend the dependency-graph showcase so the distinction is visible in the README.

Validation

• 80 tests passing on Node 22/24 CI
• Real DSH headless delivery showcase passed
• Real DSH with live OSV + npm feeds passed
• No implemented static scan findings

v0.12.0 — DSH host-runtime dependency coverage

Highlights

• Include DSH's shared profiles/node_modules host-runtime dependency plane in installed profile graphs.
• Mark physical packages as profile or dsh-host and monitor host package versions through OSV.
• Distinguish required unresolved dependencies from optional platform packages that are not installed.
• Keep host-runtime counts and coverage details visible in init and radar status.

Validation

• 79 tests passing on Node 22/24 CI
• Real DSH headless delivery showcase passed
• Real DSH with live OSV + npm feeds passed
• Real DSH web profile: 28 nodes, 22 host-runtime nodes, 0 required unresolved dependencies

See the full CHANGELOG.

v0.11.0 — Installed DSH graphs

What's new

• DSH initialization now builds the default dependency graph from the profile's installed node_modules resolution tree.
• Duplicate versions, profile-local overrides, and package-manager choices are preserved instead of being replaced by a fresh npm resolution.
• Unresolved dependency declarations remain visible as incomplete coverage in the generated config and radar status.
• Bundle and dependency manifests whose symlinks escape the DSH profile are rejected.
• --registry <url> remains available when a public npm graph comparison is intentional.

Validation

• 77 tests passed on Node.js 22 and 24 in GitHub Actions.
• Deterministic Radar showcase passed.
• Real DSH headless handoff and live OSV/npm proof passed.
• Real DSH profile init proof reported source: installed-node-modules and preserved unresolved host peers.
• Packed npm artifact contains the new installed-graph module.

v0.10.0 — First-run DSH checks

What's new

• init now auto-selects the only DSH profile that contains third-party bundles when --profile is omitted.
• Multiple candidate profiles remain explicit and fail with a useful profile list instead of guessing.
• Added read-only radar status for a local first-run snapshot: monitoring state, source health, last check, active incidents, and pending DSH analysis tasks.
• Updated the English and Chinese DSH onboarding docs and showcase.

Validation

• 72 tests passed on Node.js 22 and 24 in GitHub Actions.
• Deterministic Radar showcase passed.
• Real DSH headless handoff passed.
• Live OSV/npm DSH proof passed.
• Packed npm artifact contains the new CLI and status modules.

v0.9.0 — Simpler DSH onboarding

Simpler DSH onboarding

Upstream Radar can now generate the DSH overlay needed to start monitoring without manually exporting shell variables.

Highlights

• Run init --dsh-patch ./upstream-radar.dsh.yml to create both the reviewable dependency inventory and an explicit DSH overlay.
• Start with dsh --profile <name> --patch ./upstream-radar.dsh.yml.
• Keep the environment-variable configuration path for custom intervals and advanced setups.
• The headless showcase now exercises the same overlay writer shipped by the CLI.
• Align the runtime tool version with the npm package version and guard it with a regression test.

Verified

• 68 tests passing.
• GitHub CI passing on Node 22 and Node 24.
• Real DSH deterministic and live OSV/npm showcases passing.
• Fresh DSH profile onboarding verified with dsh-cloudflare-browser-run@0.1.1 (18 nodes, 65 edges).

v0.8.0 — Durable source health for DSH

Durable source health for DSH

Upstream Radar now remembers whether each monitoring source is healthy, rather than treating a temporary feed failure as an empty result.

Highlights

• Records the last attempt, last success, consecutive failures, and a bounded error for OSV, npm releases, and public GitHub Releases.
• Creates one project-routed DSH source-health notice after three consecutive failures.
• Does not repeat the same outage task on every poll.
• Preserves confirmed vulnerability matches and already queued DSH tasks during an outage.
• Resolves the source-health incident when the source recovers.
• Adds deterministic lifecycle evidence in examples/radar/reports/08-source-health-lifecycle.json.

Verified

• 67 tests passing locally.
• GitHub CI passing on Node 22 and Node 24.
• DSH headless deterministic report and live OSV/npm/DSH run passing.

v0.7.1 — resilient vulnerability polling

Fixed\n\n- Preserve confirmed vulnerability matches and pending DSH tasks when OSV is temporarily unavailable.\n- Never emit a false resolved event from a failed OSV check.\n- Expose sourceErrors in CLI/JSON and make one-shot checks fail closed on source errors.\n- Add a deterministic source-outage showcase.\n\n## Verification\n\n- 63 automated tests passing\n- real DSH headless handoff passing\n- live OSV/npm/DSH proof passing

v0.7.0 — GitHub Release notes

Added\n\n- Read the exact public GitHub Release tag for npm candidate versions when package metadata points to github.com.\n- Attach bounded release notes and a GitHub link to compatibility events and DSH analysis tasks.\n- Keep GitHub failures independent from OSV/npm monitoring, preserve same-candidate notes during temporary outages, and cache release lookups.\n\n## Verification\n\n- 62 automated tests passing\n- deterministic Radar showcase regenerated\n- real DSH headless handoff passing\n- live OSV/npm/DSH proof passing