v0.7.1

• Attach SLSA build provenance to the standalone release binaries. (#1351)
• Keep fixture manifests out of the npm tarball so scanners no longer report them as the package's own dependencies. (#1350)
• Shrink the install by vendoring a trimmed tree-sitter WASM. (#1352)

v0.7.0

• Cross-reference end-of-life findings with unfixed OSV advisories: import ids into registry/osv.json at build time and list them on matching findings as advisoryIds. Scans stay offline. (#1063)
• Judge committed helm template output as multi-document Kubernetes manifests, so APIs a Capabilities-guarded chart template hid become findings once rendered. Helm is never run. (#1060)
• Add an experimental Scala and sbt detector for Scala pins in .scala-version and build.sbt, and for sbt.version in project/build.properties. (#1054)
• Add an experimental Elixir and Mix detector for Elixir and Erlang/OTP pins in .tool-versions and mix.exs, and for Hex packages in mix.exs and mix.lock. (#1053)
• Judge Helm Chart.yaml dependencies that still point at the retired stable or incubator chart repositories. Templated dependency fields and repository aliases stay unclassified. (#1052)
• Judge managed Kubernetes control-plane versions in Terraform for Amazon EKS, Google Kubernetes Engine, and Azure Kubernetes Service, taking a module's vendor from its source. A variable or module reference is listed as unclassified. (#1050)
• Add --format slack, --format teams, and --format webhook to render a chat or generic webhook payload for a digest step. Evergreen renders the payload only and never sends it.
• Judge Debian, Ubuntu, and Alpine base image releases in Dockerfiles and Compose files, including codename tags such as debian:buster and ubuntu:focal. (#1051)
• Read maintainer CLE lifecycle from installed packages. (#1208)
• Generate Renovate presets from scan findings. (#1207)
• Scan SPDX 2.3 JSON SBOMs with dependency checks. (#1206)
• Scan CycloneDX SBOM components with dependency checks. (#1202)
• Enrich CycloneDX SBOMs with lifecycle milestones. (#1201)
• Export lifecycle snapshots as CLE 1.0. (#1199)
• Scan built image and rootfs for shipped OS and runtimes (#1057). (#1192)
• Judge Azure and Google Cloud database engine versions (#1056). (#1193)
• Add evergreen guard npm install (#1048). (#1190)
• Ship a language server for lifecycle diagnostics (#1046). (#1189)
• Add JUnit XML report format (#1045). (#1186)
• Scan kubectl get -o yaml dumps. (#1181)
• Add Deno and Bun runtime detection. (#1179)
• Judge runtime pins in Dockerfile RUN lines. (#1182)
• Scan terraform plan json. (#1180)
• Add Spring Boot lifecycle rules and migration fixtures. (#1161)
• Add Markdown scan report format. (#1162)

v0.6.1

Standalone binaries for v0.6.1. Release notes follow.

v0.6.0

Standalone binaries for v0.6.0 are attached below with SHA256SUMS; each carries a build provenance attestation (gh attestation verify <file> --repo arminazimi/evergreen).

Forecast and planning

• Add evergreen forecast to list what reaches end of life in the next 6 and 12 months. (#1023)
• Add --as-of <date> to scan as the world will look on that date. (#1024)
• Add --min-support-days to warn about release lines that end soon. (#1029)
• Plan an upgrade path past unsupported release lines, with safe intermediate versions. (#1025)
• Warn when a suggested replacement needs a newer runtime than the repository pins. (#1028)
• Add a lifecycle risk score from time past end of life, usage, and advisories. (#1026)
• Show how long a finding has been end of life, using git history. (#1027)
• Report deprecated transitive dependencies with the path that pulls them in. (#1030)
• Track a lifecycle debt trend in the baseline history. (#1031)

Command line

• Ship standalone binaries that need no Node.js (Linux, macOS, Windows), attached to each GitHub release with SHA256SUMS and build provenance. (#1016)
• Add --format html to scan: one self-contained HTML report with no external requests. (#1022)
• Add --format compact for agent context windows. (#1013)
• Add scan --interactive to browse findings and open them in your editor. (#1019)
• Add scan --write-status to write EVERGREEN_STATUS.md for agents. (#1008)
• Scan several paths, or a folder of repositories, in one run. (#1014)
• Add evergreen watch and a weekly digest for personal projects. (#1017)
• Print a friendly summary on a zero-config first run. (#1018)
• Add evergreen init --hooks and evergreen init --personal to install a git pre-push hook and a global config. (#999, #1020)
• Add evergreen doctor --system to check the tools installed on this machine. (#1015)
• Add evergreen setup to configure every detected agent host. (#1007)
• Add evergreen completions <bash|zsh|fish> and one example per command in --help. (#1021)
• Add stable error codes and exit codes, with JSON error output. (#1012)
• Add evergreen report-issue to build a redacted false-positive report. (#1004)
• Add a local-only usage log and evergreen usage summary. (#1010)
• Add a confidence level to every finding. (#1003)
• Add a branded SVG badge for the README. (#1142)

Rules and detectors

• Add lifecycle rules for Rails, Laravel, and React Native. (#1099, #1097, #1098)
• Add Node.js v21 and v22 lifecycle rules, and scheduled end-of-life rules for Node.js, PostgreSQL, and container images. (#932, #738)
• Judge the node-version of actions/setup-node. (#1101)
• Add migration steps and verification commands to curated rules. (#482, #993)
• Parse literal PowerShell version declarations and workflow shell and image declarations with exact lines. (#477, #478)
• Keep reading PowerShell files that use backtick line continuation. (#994)
• Promote several detectors to beta on blind-selected corpora and grow the public corpus. (#727, #728, #740)

v0.5.0

• Add end-of-life rules for every unsupported Django release series from 1.3 through 5.1 (python.package.django-<series>.eol), with the dates from the Django supported-versions page. A bounded Python package rule now matches a lockfile entry or an exact == pin, not a declared range, so a Django>=3.2 requirement alone produces no Django finding. Supported series (5.2 LTS, 6.0, 6.1) have no rule until the page gives their end dates to the day.
• Add the iOS 13 App Store upload rule (swift.app-store.ios-below-13). The Swift detector reads IPHONEOS_DEPLOYMENT_TARGET from application targets in project.pbxproj only, so libraries that declare an older platforms: minimum are not reported. (#808)
• Promote the .NET detector to beta (decision 0013). The corpus has twelve blind-selected .NET repositories on top
  of the six targeted ones (84 expected dotnet findings, precision 1 and recall 1 on the full run), and corpus
  entries gain an optional selection field that the maturity test counts.
• Add end-of-support rules for .NET Core 1.0, 1.1, 2.0, 2.1, 2.2, and 3.0, and deprecation rules for the NuGet
  packages Microsoft.Azure.DocumentDB, Microsoft.Azure.ServiceBus, and Microsoft.Azure.Storage.Blob.
  Repositories that target these lines now get findings where they had none.
• Add five pinned public repositories with independent ground truth (#493). (#985)
• Add migration steps and verification commands to curated rules (#492). (#984)
• Wire the database detector and pass conformance (#491). (#983)
• Import Redis and MongoDB vendor lifecycle signals (#490). (#982)
• Import PostgreSQL versioning policy lifecycle signals (#489). (#981)
• Add the registry file and first five lifecycle rules (#488). (#980)
• Parse engine_version on managed database resources (#487). (#979)
• Parse compose image tags with exact line locations (#486). (#978)
• Add five pinned public repositories with independent ground truth (#409). (#976)
• Add migration steps and verification commands to curated rules (#408). (#975)
• Wire the Terraform detector and pass conformance (#407). (#974)
• Import provider upgrade guide lifecycle signals (#406). (#973)
• Import Terraform CLI release support signals (#405). (#972)
• Add the registry file and first five CLI end-of-support rules (#404). (#971)
• Parse .terraform-version and .tool-versions with exact lines (#403). (#970)
• Parse .terraform.lock.hcl with exact line locations (#402). (#969)
• Parse required_version and required_providers with exact lines (#401). (#968)
• Add five pinned public repositories with independent ground truth (#429). (#967)
• Add migration steps and verification commands to curated rules (#428). (#965)
• Map affected imports and usages to files (#427). (#964)
• Wire the Dart and Flutter detector and pass conformance (#426). (#963)
• Add 94 symbol-level deprecation rules for Node.js and Python (#77). (#961)
• Evaluate symbol-level usage matchers with tree-sitter. (#960)
• Scan JavaScript, TypeScript, and Python with tree-sitter. (#959)
• Import discontinued pub packages. (#958)
• Add ten symbol-level deprecation rules for the Python standard library (#233). (#957)
• Add ten symbol-level deprecation rules for Node.js core APIs (#232). (#956)
• Add SDK lifecycle rules. (#955)
• Compare regex and tree-sitter usage engines (#230). (#953)
• Parse FVM Flutter pins. (#952)
• Python usage queries on tree-sitter (#228). (#949)
• Pin five public repositories with ground truth. (#943)
• Add migration steps and verification commands. (#944)
• Add the first five curated Azure hosted-image rules. (#940)
• Promote the detector to beta with a blind-selected corpus. (#936)
• Add @angular/core lifecycle rules and fixtures. (#928)
• Add Vue 2 end-of-life rule with fixtures and migration packet. (#927)
• Add lifecycle rules for Next.js 12 to 15. (#929)
• Promote the detector to beta with a blind-selected corpus. (#930)
• Parse pubspec.lock resolved packages and SDK constraints. (#925)
• Add migration steps to curated runtime rules. (#920)
• Parse pubspec.yaml environment and direct dependencies. (#922)
• Wire the experimental runtime lifecycle detector. (#918)
• Add reviewdog rdjson output to scan. (#919)
• Import Google Cloud Functions runtime drafts. (#917)
• Import AWS Lambda runtime lifecycle drafts. (#916)
• Seed five evidence-backed runtime lifecycle rules. (#915)
• Add Django end-of-life rules for unsupported series. (#913)
• Parse Terraform function runtime values. (#914)
• Parse serverless.yml runtime values. (#912)
• Parse SAM and CloudFormation Runtime values. (#911)
• Wire the detector and pass conformance. (#895)
• Add migration steps and verification to Play Billing rules. (#906)
• Wire the detector and pass conformance. (#876)
• Add reviewed end-of-life rules for Couchbase, ClickHouse, phpMyAdmin and CouchDB images. (#904)
• Adopt sparse corpus fetch and concurrency 16 after measuring options (#857). (#902)
• Add reviewed end-of-life rules for Drupal and Traefik images. (#901)
• Let a reviewer acknowledge a draft they chose not to take. (#900)
• Add reviewed removed-API rules from the migration guide. (#896)
• Add reviewed end-of-life rules for Caddy, Go, ZooKeeper, MariaDB and Redis images. (#897)
• Add reviewed archived-project and relocation rules. (#894)
• Add reviewed deprecated-module rules from the go-2 importer. (#893)
• Add reviewed end-of-life and abandoned-package rules. (#891)
• Add reviewed end-of-life rules for Ruby 1.9.3 through 2.6. (#889)
• Declare the files each detector reads and check the declaration (#856). (#890)
• Record a full corpus run with one command (#854). (#888)
• Run only the corpus ecosystems my change affects (#869). (#887)
• Pre-warm the corpus cache and run offline from it (#868). (#886)
• Show and prune the local corpus cache (#867). (#885)
• Compare a corpus run with the previous result (#872). (#884)
• Re-run only the repositories that failed last time (#871). (#883)
• Print a compact corpus summary and write the JSON to a file (#870). (#882)
• Fail fast on stalled corpus fetches and name slow repositories (#873). (#881)
• Report corpus run cost and set a budget (#853). (#880)
• Run a subset of the corpus by ecosystem or repository (#852). (#879)
• Cache corpus checkouts per repository and commit (#850). (#877)
• Fetch public corpus checkouts in parallel. (#875)
• Flag iOS app targets below iOS 13 for App Store uploads. (#844)
• Add swift build verification to curated migration rules. (#841)
• Map source usages to findings. (#839)
• Wire the Swift detector and pass conformance (#437). (#834)
• Add migration steps to curated lifecycle rules. (#836)
• Map package imports and calls to files. (#835)
• Register the experimental PHP detector. (#833)
• Import abandoned-package drafts from Packagist. (#832)
• Add opt-in README badge endpoint to Action. (#830)
• Promote the .NET detector to beta with a blind-selected corpus (#736). (#823)
• Record the Next.js 13 and 14 findings in excalidraw and umami. (#937)
• Report the matched declaration's line and ignore peer-only ranges. (#931)
• Accept quoted and JSON-array EVERGREEN_CHECK_COMMAND. (#921)
• Treat other-drive paths as outside the root on Windows. (#903)
• Mask verbatim strings and document source-usage limits. (#843)
• Retry flaky git fetches in the public-repository corpus run. (#840)

Lifecycle data 2026.10.21

Signed lifecycle data bundle 2026.10.21. Verify it with evergreen data update, or by hand with cosign against the certificate identity pattern in docs/decisions/0006-data-bundle.md.

v0.4.0

What's Changed

• docs: record the 0.3.0 server check in the host examples by @arminazimi in #764
• test(ruby): add positive, negative, zero-finding, and malformed fixtures (#454) by @arminazimi in #763
• feat(dashboard): build the public accuracy dashboard page (#302) by @arminazimi in #762
• feat(ci-images): parse .circleci/config.yml with exact line locations by @arminazimi in #761
• feat(ruby): parse .ruby-version and .tool-versions with exact lines (#455) by @arminazimi in #766
• feat(ci-images): parse azure-pipelines.yml with exact line locations by @arminazimi in #768
• feat(dashboard): mark stale benchmark runs on the dashboard (#303) by @arminazimi in #767
• feat(ruby): parse Gemfile with exact line locations (#456) by @arminazimi in #769
• feat(ruby): parse Gemfile.lock with exact line locations (#457) by @arminazimi in #770
• feat(ruby): parse required_ruby_version from gemspec with exact lines (#458) by @arminazimi in #771
• feat(ci-images): seed registry with curated rules by @arminazimi in #772
• feat(ci-images): import Azure hosted image retirements from runner-images by @arminazimi in #775
• feat(ruby): add lifecycle registry and five curated rules (#459) by @arminazimi in #774
• fix(ci-images): use event-free rule ids (#776) by @arminazimi in #777
• feat(ruby): import lifecycle signals from maintenance branches (#460) by @arminazimi in #778
• feat(ci-images): wire the detector and pass conformance by @arminazimi in #779
• fix(ci-images): match Azure vmImage labels case-insensitively by @arminazimi in #783
• feat(npm): add the deprecations the Renovate comparison found by @arminazimi in #782
• feat(ruby): wire the detector and pass conformance (#461) by @arminazimi in #781
• test(cpp): add positive, negative, zero-finding, and malformed fixtures by @arminazimi in #784
• test(ruby): assert migration steps and verification in packet e2e by @arminazimi in #785
• docs(ruby): document supported declarations and limits by @arminazimi in #786
• feat(cpp): parse CMakeLists.txt with exact line locations by @arminazimi in #787
• feat(usage): load tree-sitter grammars via WASM, offline (#226) by @arminazimi in #788
• feat(cpp): parse conanfile.txt and conanfile.py with exact lines by @arminazimi in #789
• feat(registry): define symbol-level API deprecation rules (#231) by @arminazimi in #790
• test(android): add positive, negative, zero, and malformed fixtures by @arminazimi in #791
• test(swift): add fixtures for Swift and Apple toolchains by @arminazimi in #792
• feat(usage): JavaScript and TypeScript usage queries on tree-sitter (#227) by @arminazimi in #794
• test: add Dart and Flutter fixtures by @arminazimi in #793
• Android: parse build.gradle(.kts) SDK literals (#412) by @arminazimi in #796
• feat(swift): parse Package.swift with exact line locations by @arminazimi in #797
• Android: parse settings.gradle / libs.versions.toml (#413) by @arminazimi in #798
• feat(swift): parse Package.resolved with exact line locations by @arminazimi in #800
• feat(swift): parse .swift-version / .xcode-version with exact lines by @arminazimi in #802
• feat(cpp): parse vcpkg.json with exact line locations by @arminazimi in #803
• test(ruby): add five pinned public repositories with independent ground truth by @arminazimi in #799
• test(php): add fixtures for composer and runtime pins (#442) by @arminazimi in #804
• feat(cpp): seed registry with five CMake lifecycle rules by @arminazimi in #806
• feat(swift): seed registry/swift.json with five curated rules by @arminazimi in #805
• Android: seed registry with first 5 curated rules (#414) by @arminazimi in #801
• feat(cpp): import CMake policy compatibility removals by @arminazimi in #809
• feat(php): parse composer.json with exact line locations (#443) by @arminazimi in #807
• feat(swift): import App Store Xcode upload requirements by @arminazimi in #811
• Android: import lifecycle signals from Google Play target API requirements (#415) by @arminazimi in #812
• feat(ruby): map affected imports and usages to files by @arminazimi in #810
• feat(php): parse composer.lock with exact line locations (#444) by @arminazimi in #813
• feat(php): parse .php-version and .tool-versions with exact lines (#445) by @arminazimi in #814
• docs(cursor): record the live Cursor 3.25.9 check by @arminazimi in #815
• docs(kilo): record the live Kilo 0.1.12 check by @arminazimi in #816
• feat(php): seed registry with five evidence-backed lifecycle rules (#446) by @arminazimi in #817
• docs(copilot): record the live VS Code Copilot check by @arminazimi in #818
• feat(php): import end-of-life drafts from PHP release branches (#447) by @arminazimi in #819
• feat: publish signed Evergreen container images to GHCR by @arminazimi in #820
• fix: respect npm deprecation version evidence by @arminazimi in #825
• chore: release 0.4.0 by @arminazimi in #821

Full Changelog: v0.3.0...v0.4.0

v0.3.0

v0.3.0

Lifecycle data 2026.10.18

Signed lifecycle data bundle 2026.10.18. Verify it with evergreen data update, or by hand with cosign against the certificate identity pattern in docs/decisions/0006-data-bundle.md.

v0.2.0

• Add the versioned Evergreen brand strategy, logo system, accessible design
  tokens, usage guide, distribution templates, and proprietary brand terms.
• Apply the approved Evergreen identity and product descriptor across repository,
  documentation, npm, Agent Skill, and GitHub Action source surfaces.
• Add the read-only evergreen doctor command with deterministic text and JSON
  output, local/GitHub/GitLab environment checks, remediation guidance, and a
  versioned public compatibility matrix.
• Add the deterministic evergreen capabilities --json auto-discovery contract,
  shared capability identifiers, public JSON Schema, committed example, and
  forward-compatibility rules.
• Add Node.js 19, 21, 23, and 25 to the end-of-life rules (#659). (#660)
• Scan every workspace package in npm, pnpm, Yarn, Lerna, and uv monorepos (#172). (#655)
• Map Go imports and calls of affected modules to files (#326). (#652)
• Register the Go importers and run them weekly. (#650)
• Add migration guidance to the Go rules (#327). (#648)
• Detect end-of-support Go releases in go.mod and go.work (#325). (#647)
• Generate a lifecycle calendar with an .ics export (#287). (#637)
• Compare Evergreen findings with Renovate by rule family (#136). (#636)
• Add the endoflife-date importer with mandatory vendor sources (#130). (#635)
• Import module deprecation notices. (#634)
• Draft lifecycle rules weekly and open one pull request per importer (#122). (#633)
• Add release policy importer. (#632)
• Add lifecycle rules. (#629)
• Add the container-official-images importer (#335). (#628)
• Add migration guidance to the container rules (#337). (#627)
• Detect end-of-life base images in Dockerfiles and Compose files. (#626)
• Seed the container registry with five vendor-sourced rules (#334). (#625)
• Parse service images from Compose files (#333). (#624)
• Parse FROM instructions from Dockerfiles (#332). (#623)
• Describe the MCP server for the official registry, and make npx evergreen-deprecation work. (#619)
• Add evergreen init --agents. (#617)
• Parse go.work declarations. (#615)
• Parse go.mod declarations. (#613)
• Refuse detector ids and registry namespaces that are already in use. (#612)
• Add the parser template and check the scaffold templates against conventions. (#611)
• Add evergreen new-detector. (#609)
• Add third Python lifecycle rule batch. (#608)
• Add fourth npm lifecycle rule batch. (#607)
• Show lifecycle data age and stale warnings in every output. (#605)
• Pin the lifecycle data version. (#603)
• Add evergreen data update. (#602)
• Add evergreen data status. (#601)
• Verify the lifecycle data bundle before loading it. (#600)
• Add third npm lifecycle rule batch. (#599)
• Build the lifecycle data bundle reproducibly. (#597)
• Add second Python lifecycle rule batch. (#595)
• Add outputSchema to every MCP tool. (#593)
• Add the migrate-finding MCP prompt. (#592)
• Expose findings observed in the session as MCP resources. (#591)
• Expose lifecycle rules as MCP resources. (#590)
• Add first Python lifecycle rule batch. (#589)
• Evaluate dependency-guard triggering across agents. (#587)
• Warn when a Codex patch adds a deprecated dependency. (#586)
• Add second npm lifecycle rule batch. (#584)
• Warn when a Claude Code edit adds a deprecated dependency. (#585)
• Add the check_dependency MCP tool. (#583)
• Add the evergreen check command. (#582)
• Add the checkDependency core API. (#581)
• Measure adoption weekly from public data without telemetry. (#580)
• Add ten curated GitHub Actions lifecycle rules (batch 2). (#579)
• Add ten curated GitHub Actions lifecycle rules (batch 1). (#578)
• Upload findings to code scanning from the GitHub Action. (#576)
• Add rule help and evidence to SARIF output. (#574)
• Add a deterministic SARIF 2.1.0 reporter. (#573)
• Add first npm lifecycle rule batch. (#572)
• Draft the changelog and release notes from conventional commits. (#567)
• Report unclassified action pins. (#566)
• Regenerate action SHA map. (#564)
• Enforce per-detector precision floors in the corpus run. (#563)
• Classify known action SHA pins. (#562)
• Classify SHA-pinned actions from trailing version comments. (#560)
• Grow the validation corpus to 50 repositories and review npm, Python and runtime migrations. (#559)
• Report checkout time separately from scan time in the corpus harness. (#558)
• Add ten reviewed GitHub Actions repositories to the validation corpus. (#555)
• Record reviewed and rejected corpus candidates. (#554)
• Add the GitHub-hosted runner image importer. (#552)
• Add the GitHub Actions runtime importer. (#551)
• Add the PyPI project status importer. (#550)
• Add the npm deprecation importer. (#549)
• Add the Python release cycle importer. (#548)
• Mine migration commit candidates. (#547)
• Add the Node.js release schedule importer. (#546)
• Generate a reviewable pull-request body for importer drafts. (#545)
• Diff importer drafts against the registry. (#544)
• Add offline recording and replay for importer tests. (#543)
• Define the lifecycle importer interface. (#542)
• Schedule a weekly source-freshness check. (#538)
• Migrate the GitHub Actions registry to rule format v2. (#537)
• Migrate the Python registry to rule format v2. (#536)
• Migrate the npm registry to rule format v2. (#535)
• Migrate the Node.js registry to rule format v2. (#534)
• Add a v1 to v2 registry conversion tool. (#533)
• Load v1 and v2 registries side by side. (#532)
• Validate registry v2 provenance, sources, and freshness. (#531)
• Export detector conformance harness. (#530)
• Add NuGet and RubyGems comparators for VERS. (#529)
• Add the Maven comparator for VERS. (#527)
• Add the PEP 440 comparator for VERS. (#525)
• Add the semver comparator for VERS. (#523)
• Implement VERS range parsing and containment. (#521)
• Add PURL identity helpers. (#517)
• Define the registry v2 JSON Schema. (#516)
• Package and validate Codex plugin. (#66)
• Prepare Codex plugin submission. (#65)
• Publish Claude plugin marketplace. (#64)
• Add cross-host plugin release gates. (#63)
• Define shared plugin packaging architecture.
• Add reproducible skill trigger evaluations.
• Publish capability manifest.
• Add environment doctor.
• Add Evergreen logo system.
• Use the Release schedule end dates for Node.js 18 and 20 (#654, #644). (#658)
• Read pnpm lockfiles that contain several YAML documents. (#656)
• Record the SHA-pinned findings that comment classification now reports in the corpus. (#561)