v11.0.2

11.0.2 (2026-09-01)

Fixes & improvements

• refactor: simplify internals (266b797)
• docs: update migration notes (0583363)

v11.0.1

11.0.1 (2026-09-01)

Fixes & improvements

• fix: restore gh registry grants (def353e)

v11.0.0

11.0.0 (2026-09-01)

Features

• feat(cli): --json machine-readable remediation outcome (ab9b0dc)
• feat(audit): scope fixes to production deps / selected workspaces (8f6764f)
• feat(audit): package-type (cjs) constraint + --safe bundle (8975216)
• feat(audit): --engines.=floor scans workspace manifests too (58c8264)
• feat(audit): monorepo-aware manifest gate (c9bfa92)
• feat(audit): --engines.=floor infers the target from the tree (e537628)
• feat(audit): gate the fix version itself, not just its closure (45de57a)
• feat(audit): license allow/deny constraint for remediation (0aafc8b)
• feat(audit): opt-in engine constraints for remediation (b9ec4c8)
• feat(audit): pin berry cache checksums across all yarn generations (af49c96)
• feat(audit): overrides/resolutions during remediation imprs (7ab7b0c)
• feat(audit): honor package overrides/resolutions during remediation (52733fa)
• feat: live progress for the resolve/complete phase (9975233)
• feat: cooperative sigint — AbortSignal cancels in-flight registry HTTP (6e8f2e9)
• feat: complete install-free patch (lockfile .73) + progress spinner (2eba1af)
• feat: apply --exclude/--ignore client-side (package globs / advisory ids) (5800983)
• feat(audit): annotate each upgrade with severity, CVSS and CVE/GHSA refs (b02c61f)
• feat(audit): yarn 4+ support (47875a0)

Fixes & improvements

• perf(audit): bound registry concurrency + cache packument GETs (ecc6ad6)
• fix(audit): correct yarn-classic resolved host + sha1 in remediation output (9ec30bf)
• refactor(audit): drop the in-house registry client — delegate to @antongolub/lockfile (c2b79ac)
• fix(audit): yarn-berry .yarnrc.yml npmAuthToken was silently dropped (fb42cf6)
• refactor: remove dead code — spawn-era flag helpers (2e9b630)
• refactor: drop the PM-CLI audit-output parsers (a726924)
• fix(deps): bump @antongolub/lockfile to 0.0.0-snapshot.80 + preserve base danglers on prune (0ae1fcc)
• refactor: drop the yarn/npm binaries entirely — spawn-free, registry-only (e87361e)
• refactor: drop npm/yarn bins + versions from the runtime digest (c559507)
• fix(deps): bump @antongolub/lockfile to 0.0.0-snapshot.76 (yarn-3 refurbish) (dfce044)
• fix(deps): bump @antongolub/lockfile to 0.0.0-snapshot.69; regen goldens (1864cc9)
• fix: handle Ctrl+C/SIGINT gracefully (9592d71)
• refactor: replace commander with a tiny minimist-based CLI parser (8daf188)
• docs: v11 announce (f54a8ed)
• docs: tighten code comments and README (64078e9)
• fix: enhance semver range protection (ccd46ec)
• fix(patch): phase graph mutation so parent+child upgrades never reject (ac9177c)
• fix(patch): handle vulnerable parent + child in one upgrade pass (e022b80)
• refactor: separate v4 advisory flow (a715a62)
• fix(audit): resolve fix versions against the registry; idempotent yarn 4 runs (491985f)

BREAKING CHANGES

• significant parts have replaced via @antongolub/lockfile, backward compatibility cannot be guaranteed (47875a0)

v10.1.1

10.1.1 (2024-11-29)

Fixes & improvements

• fix: up deps to fix cross-spawn vuln (faafdeb)

v10.1.0

10.1.0 (2024-10-26)

Features

• feat: use "exclude" and "ignore" CLI options when running yarn npm audit command (015a4b9)
• feat: support multi-value CLI options (2664c66)

v10.0.9

10.0.9 (2024-08-21)

Fixes & improvements

• fix(deps): update dependency commander to v12 (3fe23a1)

v10.0.8

10.0.8 (2024-08-06)

Fixes & improvements

• fix: apply object key sort to npm view deps output (#336) (106229b)
• fix: set shell true to handle sec fix for windows (#335) (6a29f1c)

v10.0.7

10.0.7 (2023-11-23)

Fixes & improvements

• fix(deps): update dependency commander to v11 (1cd29fa)

v10.0.6

10.0.6 (2023-11-22)

Fixes & improvements

• refactor: use os.temp() instead of find-cache-dir (85776a0)
• fix: rm find-up and pkg-dir from deps to bring back nodejs 16 support (5ac29c1)

v10.0.5

10.0.5 (2023-11-16)

Fixes & improvements

• fix(deps): update dependency find-up to v7 (284fb63)