v0.134.0

Added

• A server that needs a newer Draugr says which version, and the scan says how to get it. When a draugr-api server refuses a run as too old, the error names the version it needs, the version you ran, and draugr self-update, instead of the server's error code.

• draugr init reads the tree and enables what it finds. Copied JavaScript enables retire.js, a setup.py or pdm.lock enables Grype, Go enables gosec and govulncheck reachability, and an OpenAPI document adds a commented host. Each line's comment names the files behind it; unread dependency files are listed. --per-directory writes a component per directory holding a dependency file.

Changed

• release.version is optional. A Saga that names its project and its components is complete, and draugr init no longer writes a placeholder 0.0.0. A version, where one is given, still labels every report and the VEX product identifier.

Fixed

• A bun.lockb or a conda environment.yml appears under Unread with the reason no packages read. Both were counted as checked, though no scanner checks the packages in either.

• The github and draugr-api publisher errors no longer point at config.reports. A missing report named the removed key as the place to add it, and a descriptor that followed the advice was refused.