v11.0.0

11.0.0 (2026-09-01)

Features

• feat(cli): --json machine-readable remediation outcome (ab9b0dc)
• feat(audit): scope fixes to production deps / selected workspaces (8f6764f)
• feat(audit): package-type (cjs) constraint + --safe bundle (8975216)
• feat(audit): --engines.=floor scans workspace manifests too (58c8264)
• feat(audit): monorepo-aware manifest gate (c9bfa92)
• feat(audit): --engines.=floor infers the target from the tree (e537628)
• feat(audit): gate the fix version itself, not just its closure (45de57a)
• feat(audit): license allow/deny constraint for remediation (0aafc8b)
• feat(audit): opt-in engine constraints for remediation (b9ec4c8)
• feat(audit): pin berry cache checksums across all yarn generations (af49c96)
• feat(audit): overrides/resolutions during remediation imprs (7ab7b0c)
• feat(audit): honor package overrides/resolutions during remediation (52733fa)
• feat: live progress for the resolve/complete phase (9975233)
• feat: cooperative sigint — AbortSignal cancels in-flight registry HTTP (6e8f2e9)
• feat: complete install-free patch (lockfile .73) + progress spinner (2eba1af)
• feat: apply --exclude/--ignore client-side (package globs / advisory ids) (5800983)
• feat(audit): annotate each upgrade with severity, CVSS and CVE/GHSA refs (b02c61f)
• feat(audit): yarn 4+ support (47875a0)

Fixes & improvements

• perf(audit): bound registry concurrency + cache packument GETs (ecc6ad6)
• fix(audit): correct yarn-classic resolved host + sha1 in remediation output (9ec30bf)
• refactor(audit): drop the in-house registry client — delegate to @antongolub/lockfile (c2b79ac)
• fix(audit): yarn-berry .yarnrc.yml npmAuthToken was silently dropped (fb42cf6)
• refactor: remove dead code — spawn-era flag helpers (2e9b630)
• refactor: drop the PM-CLI audit-output parsers (a726924)
• fix(deps): bump @antongolub/lockfile to 0.0.0-snapshot.80 + preserve base danglers on prune (0ae1fcc)
• refactor: drop the yarn/npm binaries entirely — spawn-free, registry-only (e87361e)
• refactor: drop npm/yarn bins + versions from the runtime digest (c559507)
• fix(deps): bump @antongolub/lockfile to 0.0.0-snapshot.76 (yarn-3 refurbish) (dfce044)
• fix(deps): bump @antongolub/lockfile to 0.0.0-snapshot.69; regen goldens (1864cc9)
• fix: handle Ctrl+C/SIGINT gracefully (9592d71)
• refactor: replace commander with a tiny minimist-based CLI parser (8daf188)
• docs: v11 announce (f54a8ed)
• docs: tighten code comments and README (64078e9)
• fix: enhance semver range protection (ccd46ec)
• fix(patch): phase graph mutation so parent+child upgrades never reject (ac9177c)
• fix(patch): handle vulnerable parent + child in one upgrade pass (e022b80)
• refactor: separate v4 advisory flow (a715a62)
• fix(audit): resolve fix versions against the registry; idempotent yarn 4 runs (491985f)

BREAKING CHANGES

• significant parts have replaced via @antongolub/lockfile, backward compatibility cannot be guaranteed (47875a0)