v0.13.0

v0.13.0: --online OSV vulnerability aggregation (D1 roadmap).

• lib/osv.js: OSV querybatch API, zero deps
• cli --online: dependencies -> known vulnerabilities
• auditRemote returns dependencies
• Real verify: dsh-taskboard 7 deps -> 3 GHSA findings
• 78 tests green
• npm: dsh-stability-audit@0.13.0

v0.12.4

v0.12.4: dormancy detection.

• dormancy: {dormant, lastCommitHours, hint}

• 180 days without commits -> dormant (zombie plugin, dependency-scout insight)

• Report shows [dormant]; JSON carries dormancy
• Verified: synthetic 200-day-old repo -> dormant:true (4800h)
• 73 tests green
• npm: dsh-stability-audit@0.12.4

v0.12.3

v0.12.3: release freshness annotation.

• freshness: {ageHours, level: very-fresh/recent/stable, hint}
• <24h flagged as supply-chain attack window (dependency-scout insight)
• Negative ages clamped to 0
• Real verify: chicheng-cron 7.9h -> very-fresh (actual fresh push caught)
• 72 tests green
• npm: dsh-stability-audit@0.12.3

v0.12.2

v0.12.2: data-freshness annotation.

• auditRemote captures audited commit (rev-parse --short HEAD) as sourceCommit
• Report header shows (commit xxxxxxx); JSON carries sourceCommit
• Results never silently go stale: users see which code a verdict refers to
• Real verify: dsh-speak -> 24393a8
• 71 tests green
• npm: dsh-stability-audit@0.12.2

v0.12.1

v0.12.1: install-blocked short-circuit (battle-test fix).

• dyncheck now short-circuits on install failure with installStatus (install-blocked/install-failed)
• Report tags [install-blocked]
• docs/BATTLE-TEST.md: 12-plugin real test
• 70 tests green
• npm: dsh-stability-audit@0.12.1

v0.12.0

v0.12.0: profile dependency-tree scan.

• lib/lockscan.js: parse pnpm-lock.yaml (zero deps): total packages, hasBin risk surface, @deepseek-ai/* vs host versions
• cli --lock : dependency-tree health report
• Real scan: 231 packages, 3 hasBin (2 git-source), host versions consistent
• 69 tests green
• npm: dsh-stability-audit@0.12.0

v0.11.1

v0.11.1: user-visible strings to English.

• All user-visible output now English (FIX suggestions, rule descriptions, tool description, CLI hints, report, error messages)
• Chinese kept only in dev comments
• 66 tests green
• npm: dsh-stability-audit@0.11.1

v0.11.0

v0.11.0: remote endpoint extraction + exfil patterns.

• Extract hardcoded URLs/WebSockets (yellow, human review)
• Flag process.env exfiltration via fetch/WebSocket (red, OpenClaw 341-event pattern)
• renderJson carries endpoints field
• Real scan: 28 plugins, 8 yellow + 1 red (dsh-test-drive needs confirmation)
• 66 tests green
• npm: dsh-stability-audit@0.11.0

v0.10.1

v0.10.1: auto-scan at plugin startup.

• apply() schedules an async static audit 3s after boot
• Refreshes ~/.dsh/stability-report.json + change-detection baseline
• Zero output, fully silent on failure
• User sees summary + change hints on next explicit call (passive-scan pattern)
• 61 tests green
• npm: dsh-stability-audit@0.10.1

v0.10.0

v0.10.0: report persistence + change detection + focus mode.

• Audit results persist to ~/.dsh/stability-report.json
• Change detection: only signals when red/yellow state CHANGES (avoids alert fatigue)
• focus=true: red/yellow only
• Summary line in output
• Zero dependencies preserved (61 tests green)
• npm: dsh-stability-audit@0.10.0