Release Beacon 1.2.0 · martin-k-m/beacon

Beacon 1.2.0

npm install -g @martin-k-m/beacon-cli
beacon analyze facebook/react

Remote analysis reported every repository as having zero dependencies. The GitHub collector hardcoded dependencyCount: 0 for each detected manifest, so a repository with 50 dependencies reported 0. Remote collection lists the repository tree without reading manifest contents, so the count is genuinely unknown there and now reports null. Local analysis (--local) parses manifests off disk and still reports real counts.

Plugins are now reachable. @beacon/plugins was built and tested but imported by nothing, so no plugin could ever run. Plugins are now a self-hosting feature: BEACON_PLUGINS loads modules at API boot, GET /api/plugins lists what is loaded, GET /api/repositories/:owner/:repo/plugins runs analyzers and recommenders, and plugin widgets render through the existing /widget/:type/:owner/:repo route (same cache, same error card; built-in types keep precedence). A plugin that fails to import, or throws, is logged and skipped — it never stops the API booting. See docs/plugins.md.

vitest 2 → 3 across all nine packages that declare it, clearing 10 critical advisories. Development-only — a test runner is never shipped.
Next.js 14.2.35 → 15.5.20, clearing 28 advisories including 10 high.
esbuild 0.24 → 0.25 (development).
The published CLI was never affected by any of the above: it has zero runtime dependencies.

BREAKING (type): DependencyManifest.dependencyCount is now number | null. null means "unknown", never "none". Consumers reading it from beacon analyze --json or @beacon/sdk must handle null — remote analyses now emit null where they previously emitted 0.
React 18 → 19 and Recharts 2 → 3 in the dashboard, plus Next 15 async route params.

Verified from a clean npm ci: lint 26 · typecheck 26 · test 20 (141 tests) · build 15.