Develra v0.2.0

Develra v0.2.0

Develra v0.2.0 adds an explicit, privacy-bounded public registry check while
keeping every default scan and check offline.

Added

• Run develra check --registry https://www.develra.dev/api to compare the
  providers and operations detected locally with Develra's public change feed.
• Validate remote responses, pagination, duplicate records, redirects, timeouts,
  and decompressed response size before using registry data.
• Report relevant upstream changes and official source provenance in console,
  JSON, Markdown, and SARIF output.
• Distinguish optional registry failures with exit code 4; remote findings stay
  informational and do not replace local inventory policy.

Privacy and scope

The CLI sends only detected provider IDs. It does not send source code,
lockfile contents, repository names, evidence paths, credentials, environment
values, or authorization headers. The registry is never contacted without the
explicit --registry option.

The first public feed is deliberately small and manually curated from official
provider sources. It has no accounts, authentication, database, inventory
upload, background polling, or AI classification and should not be treated as a
comprehensive monitoring service.

Verify the release

npx develra@0.2.0 --version
npx develra@0.2.0 check --registry https://www.develra.dev/api

Use the compatible Action channel in GitHub workflows:

- uses: develra-dev/develra@v0
  with:
    command: check

Full documentation and source: https://github.com/develra-dev/develra

Develra v0.1.2

Develra v0.1.2

Develra v0.1.2 adds bounded Python lockfile resolution while preserving the
local-first scanner's existing privacy and determinism guarantees.

Added

• Resolve direct dependency versions from poetry.lock, uv.lock, and
  Pipfile.lock when a supported Python manifest exists in the same directory.
• Normalize PyPI package names before correlating manifest and lockfile data.
• Keep ambiguous, non-registry, and marker-specific resolutions on their
  manifest evidence instead of guessing a locked version.
• Report malformed, orphaned, or unsupported lock inputs with at most one
  concise diagnostic per file.

Locked transitive packages do not become direct dependencies. Default scans
remain offline and never execute project code or package tooling.

Repository hygiene

• Updated the synthetic Python fixture to requests 2.33.0 and urllib3
  2.7.0, resolving dependency alerts in test data. These packages are fixture
  text only and are not installed or executed by Develra.

Verify the release

npx develra@0.1.2 --version
npx develra@0.1.2 scan

Use the compatible Action channel in GitHub workflows:

- uses: develra-dev/develra@v0
  with:
    command: check

Full documentation and source: https://github.com/develra-dev/develra

Develra v0.1.1

Develra v0.1.1

Develra v0.1.1 is a security maintenance release for the bundled GitHub
Action. Scanner behavior and lockfile output are unchanged from v0.1.0.

Security

• Updated the official GitHub Actions toolkit dependency from @actions/core
  1.11.1 to 2.0.3.
• Replaced bundled undici 5.29.0 with patched 6.28.0.
• Confirmed the production dependency graph has no known vulnerabilities with
  pnpm audit --prod.

The standalone npm CLI continues to have zero runtime dependencies and default
scans remain offline.

Verify the release

npx develra@0.1.1 --version
npx develra@0.1.1 scan

Use the patched Action channel in GitHub workflows:

- uses: develra-dev/develra@v0
  with:
    command: check

Full documentation and source: https://github.com/develra-dev/develra

Develra v0.1.0

Develra v0.1.0

Develra is a local-first lockfile and scanner for the external APIs, SDKs,
endpoints, outbound webhooks, and MCP servers a repository appears to depend
on. The first release works without an account, hosted backend, API key, or
source upload.

Highlights

• Run npx develra scan to create a deterministic, reviewable
  develra.lock.
• Run npx develra check to enforce the committed inventory in local or CI
  workflows.
• Scan JavaScript, TypeScript, Python, raw HTTP endpoints, webhook-like URL
  configuration, and static project-level MCP JSON.
• Distinguish confirmed, probable, and possible evidence instead of
  treating installation as active use.
• Preserve unknown external hosts so unsupported services remain visible.
• Generate console, JSON, Markdown, standalone SVG, and SARIF reports.
• Use develra-dev/develra@v0 as a bundled, read-only GitHub Action.
• Extend detection through schema-validated declarative provider packs.

Initial provider catalog

Anthropic, Clerk, GitHub, OpenAI, Resend, Shopify, Slack, Stripe, Supabase, and
Twilio.

Privacy and safety

Default scans are offline and telemetry-free. Develra does not execute project
code, lifecycle scripts, binaries, or MCP servers. It rejects filesystem
escapes and does not write source snippets, environment values, authorization
headers, tokens, URL queries, or absolute local paths into the lockfile.

Known limitations

• Detection is shallow and intra-file; dynamic values and whole-program alias
  propagation are intentionally not evaluated.
• Yarn and resolved Python lockfile parsing are deferred.
• MCP support covers static project-level JSON configuration, not server
  execution or live schema negotiation.
• Unknown custom domains remain unknown rather than being guessed.
• Provider coverage is deliberately conservative and will grow through tested
  provider-pack contributions.

Verify the release

npx develra@0.1.0 --version
npx develra@0.1.0 scan

Full documentation and source: https://github.com/develra-dev/develra