v0.2.0

Added

• Plugin lifecycle hook: plugins can implement init(ctx: PluginContext) to receive CacheService after services are created but before data collection. PluginContext is exported from @dependicus/core.
• softDependsOn on DataSource: sources can declare optional ordering dependencies that are respected when present in the pool and silently ignored when absent. Provider sources and plugin sources now run in a single topological sort per ecosystem, so plugin sources can declare ordering relative to provider sources.
• ColumnContext type in @dependicus/core shared by CustomColumn callbacks and UsedByGroupKeyFn, carrying name, version, store, and ecosystem in one object.
• CacheService is now re-exported from the top-level dependicus package, so plugins and consumers no longer need to import it from @dependicus/core directly.
• getGroupingFilename() helper for building URL-safe filenames from grouping values, analogous to getDetailFilename() for dependency pages.
• SecurityPlugin for querying public vulnerability databases (OSV, deps.dev, GitHub Advisory) and enriching the dashboard with severity, fix availability, deprecation status, and advisory details. Findings are attached to Linear and GitHub issue tickets and shown on grouping detail pages. Enable via --vuln-source CLI flag or programmatically.
• Issue lifecycle comments: when Dependicus closes or reopens an issue, it posts a comment explaining why with version details and policy context. Plugins can contribute additional context via commentSections on the issue spec (same shape as descriptionSections).
• Closed-issue reopen: when about to create a new issue, Dependicus first searches for a closed issue with an identical title and reopens it instead of creating a duplicate.
• Flapping prevention: the close loop skips closing when a dependency or group was absent from provider input, preventing spurious close/reopen cycles caused by transient provider failures or external agents closing tickets.

Changed

• Breaking: CustomColumn.getValue, getTooltip, and getFilterValue now take a single ColumnContext argument instead of (name, version, store, ecosystem).
• Breaking: UsedByGroupKeyFn now takes ColumnContext instead of (name, version, store).
• Breaking: buildIssueDescription and buildGroupIssueDescription in both @dependicus/linear and @dependicus/github-issues now take a single params object (IssueDescriptionParams / GroupDescriptionParams) instead of positional arguments.
• Breaking: Plugin issue spec merging no longer validates with Zod immediately. ResolvedPlugins.getLinearIssueSpec and getGitHubIssueSpec return Partial<Spec> | undefined. Validation happens in the CLI after flag injection via new validateLinearIssueSpec / validateGitHubIssueSpec helpers.
• Breaking: Direct config.linear.getLinearIssueSpec and config.github.getGitHubIssueSpec are now merged with plugin specs instead of overriding them. Config specs provide defaults; plugin specs can override scalar fields; descriptionSections from all sources are concatenated.

Fixed

• Grouping detail pages (surfaces, teams) with spaces, parentheses, or other URL-unsafe characters in their names now produce sanitized filenames instead of raw values, fixing 404s on static file servers.
• The pnpm and aube providers now work on single-package repos (no pnpm-workspace.yaml). Previously they unconditionally used -r list which could produce malformed output or error outside a workspace.