v0.2.0

What's Changed

• feat(registry): read publish times out of an npm packument (#23 part 3, 1/2) by @kms8720 in #61
• feat(cli): deptrail advisory derive (#23 part 3, 2/2) by @kms8720 in #62
• refactor(fetch): move the transport out of registry.py (#23 part 4 prep) by @kms8720 in #63
• feat(osv): take the malicious version list from OSV (#23 part 4, 2/3) by @kms8720 in #64
• feat(feeds): ship the September 2025 incident, validated end to end (#23 part 4, 3/3) by @kms8720 in #67
• feat(yaml): read the YAML subset lockfiles are written in, and refuse the rest (#17 part 1) by @kms8720 in #69
• fix(yaml): read flow collections Prettier broke across lines, and retract a false claim by @kms8720 in #78
• feat(pnpm): split a pnpm package key into a name and a version, three grammars deep (#17 part 2a) by @kms8720 in #81
• feat(lockfile): an origin per package, an unread channel, and a text lockfileVersion by @kms8720 in #84
• feat(pnpm): read a whole pnpm-lock.yaml into the LockfileModel by @kms8720 in #85
• feat(pnpm): judge pnpm trees in the history walk by @kms8720 in #86
• feat(yarn): read a Yarn Berry yarn.lock into the LockfileModel by @kms8720 in #88
• feat(yarn): judge Berry trees in the history walk, and sniff the format per blob by @kms8720 in #90

Full Changelog: v0.1.1...v0.2.0

v0.1.1

What's Changed

• docs(readme): swap to pip install deptrail now that 0.1.0 is published by @kms8720 in #57
• chore(release): 0.1.1 — replace the PyPI project page, and land two fixes that didn't by @kms8720 in #59

Full Changelog: v0.1.0...v0.1.1

v0.1.0

What's Changed

• feat(lockfile): normalized parser for npm lockfileVersion 1/2/3 by @kms-spaceai in #1
• feat(history): lockfile git history walker with attack-window judgment by @kms-spaceai in #8
• feat(ioc): advisory schema, strict loader, and query plan by @kms-spaceai in #11
• feat(grading): correlate CI runs with exposures and grade the evidence by @kms-spaceai in #12
• feat(org): organization scan, incident timeline, and secrets rotation list by @kms-spaceai in #13
• feat(cli): deptrail command, offline demo, HTML report, and GitHub Action by @kms-spaceai in #15
• fix(history): never report a tree we could not read as clean by @kms-spaceai in #26
• fix(cli): an incomplete view is "could not prove absence", not "rotate" by @kms-spaceai in #28
• feat(cli): deptrail advisory init and validate by @kms8720 in #31
• fix(report): group caveats by sentence instead of deduplicating prose by @kms8720 in #34
• fix(org): preserve uncertainty in workflow evidence by @kms8720 in #43
• fix(ioc): allow the window's right edge to remain open by @kms8720 in #44
• feat(ioc): show where every judgment window came from by @kms8720 in #45
• fix(ioc): reject duplicate effective package waves by @kms8720 in #46
• fix(cli): name dot-path repositories in reports by @kms8720 in #47
• test(ci): run on macOS and Windows by @kms8720 in #48
• fix(ioc): reject control characters in timestamp bounds by @kms8720 in #49
• fix(grading): cap open-window installs at likely by @kms8720 in #50
• fix(org): never cache moving ref resolutions by @kms8720 in #51
• chore(release): make 0.1.0 publishable, and check it before it ships by @kms8720 in #52

New Contributors

• @kms-spaceai made their first contribution in #1
• @kms8720 made their first contribution in #31

Full Changelog: https://github.com/Official-Space-AI/deptrail/commits/v0.1.0