v2.0.1

Same code as 2.0.0, one change: the Zed extension id is depsy-lsp instead of depsy.

Zed's extension publishing prerequisites require extensions that only ship a language server to carry an -lsp or -language-server suffix, and the registry review asked for it (zed-industries/extensions#7385). The extension is still called Depsy in the extensions panel, the settings key is still lsp.depsy, and lsp.dependi.initialization_options is still read as a fallback.

Coming from Dependi: search for "Depsy" in the Zed extensions panel, install it, uninstall dependi. Nothing to change in your settings.

Full Changelog: v2.0.0...v2.0.1

What's Changed

• chore: rename extension id to depsy-lsp (v2.0.1) by @mpiton in #391

Full Changelog: v2.0.0...v2.0.1

v2.0.0

First release under the Depsy name.

Depsy is the extension previously published as Dependi. The rename was requested by the Dependi (dependi.io) maintainers, who are publishing their own Zed extension under the dependi id. Background in #377.

What changed since 1.10.0:

• The extension id is depsy, the language server binary is depsy-lsp, the settings key is lsp.depsy, and the cache moved to ~/.cache/depsy.
• lsp.dependi.initialization_options is still read as a fallback, so an existing configuration keeps working. The "ignore this package" code action also carries the entries of the old ignore list over to lsp.depsy, because Zed replaces arrays when it merges the two keys and would otherwise drop them.
• aarch64 Linux builds work again with Rust 1.98 (cargo-zigbuild 0.23.2).
• h2 bumped to 0.4.19 for RUSTSEC-2026-0258.

Nothing else changed: same parsers, registries, diagnostics and code actions as 1.10.0.

Migrating from Dependi:

1. Install Depsy from the Zed extensions panel (extension id depsy-lsp as of 2.0.1, see the 2.0.1 notes). It shows up once zed-industries/extensions#7385 is merged.
2. Uninstall dependi.
3. Rename lsp.dependi to lsp.depsy in your settings when convenient. Not required.

Full Changelog: v1.10.0...v2.0.0

v1.11.0

Last release under the Dependi name.

The extension is being renamed to Depsy at the request of the Dependi (dependi.io) maintainers, who are publishing their own Zed extension under the dependi id. Details in #377.

What changed since 1.10.0:

• A warning is shown when the language server starts, pointing to the new extension.
• The Zed extension downloads the language server from this release only, so later Depsy releases (renamed assets) can't break installs that haven't migrated.
• Nothing else. Same features and fixes as 1.10.0.

What to do:

1. Install the depsy extension. It isn't in the Zed registry yet; it lands with the 2.0.0 release shortly after this one.
2. Uninstall dependi.
3. Your lsp.dependi.initialization_options keep working with Depsy. Rename the key to lsp.depsy when you get to it.

dependi receives no further updates. The repository moves to https://github.com/mpiton/zed-depsy with the 2.0.0 release.

Full Changelog: v1.10.0...v1.11.0

v1.10.0

What's Changed

• fix(lsp): preserve version constraints in update actions by @mpiton in #353
• feat: support .NET directory props manifests by @mpiton in #354
• chore: remove redundant artifacts and fixtures by @mpiton in #355
• chore(release): prepare v1.10.0 by @mpiton in #356

Full Changelog: v1.9.1...v1.10.0

v1.9.1

What's Changed

• [US] perf-reduce-tokio-feature-set-decrease: trim Tokio feature set by @mpiton in #336
• docs: sync CLI, env vars and dev scripts with current code by @mpiton in #337
• chore(deps): update Rust dependencies and actions by @mpiton in #348
• chore(release): prepare v1.9.1 by @mpiton in #349

Full Changelog: v1.9.0...v1.9.1

v1.9.0

What's Changed

• Add CodSpeed continuous performance testing by @codspeed-hq[bot] in #282
• fix(fuzz): migrate fuzz targets to name_span/version_span API by @mpiton in #287
• fix(parsers/cargo): guard against TextSize underflow on malformed input by @mpiton in #288
• fix(parsers/cargo): exclude trailing newline from line_ranges by @mpiton in #289
• [US] pnpm-workspace-catalog-support: support pnpm workspace catalog dependencies by @mpiton in #318
• chore(deps): update project dependencies by @mpiton in #319
• chore(release): prepare v1.9.0 by @mpiton in #320

Full Changelog: v1.8.1...v1.9.0

v1.8.1

What's Changed

• fix(npm): accept boolean deprecated field on version metadata by @mpiton in #278
• chore(release): v1.8.1 by @mpiton in #279

Full Changelog: v1.8.0...v1.8.1

v1.8.0

What's Changed

• deps: consolidate Dependabot updates (April 2026) by @mpiton in #251
• Track Cargo dep package field, and name and version lines by @DanikVitek in #250
• feat: Add Maven/pom.xml support (#223) by @mpiton in #252
• refactor: drop unused Serialize/Deserialize derives on Dependency/Span by @mpiton in #254
• feat: scan lockfiles for transitive vulnerability detection (#224) by @mpiton in #255
• feat(scan): add HTML output format for vulnerability reports by @mpiton in #260
• fix: handle bare PEP 440 pre-release in version comparison (#154) by @mpiton in #261
• feat: add 'Ignore package' code action (#226) by @mpiton in #262
• document npm OSV vulnerability scan by @mpiton in #264
• fix: limit OSV RustSec advisory concurrency by @mpiton in #265
• fix(registries): sanitize repository and homepage URLs for npm and Packagist (#230) by @mpiton in #266
• perf(cache): make ReadCache/WriteCache async, offload SQLite to spawn_blocking by @mpiton in #267
• feat(cache): hybrid memory+SQLite advisory cache for RustSec data by @mpiton in #268
• refactor(parsers): introduce LockfileResolver trait (#239) by @mpiton in #269
• refactor(python): decompose parse_pyproject_toml using taplo spans (#240) by @mpiton in #270
• perf(parsers): replace string-scan with span-aware JSON parser (#236) by @mpiton in #271
• chore: untrack docs/plans by @mpiton in #272
• docs: enhance API documentation with Rustdoc comments by @mpiton in #273
• chore(docs): enforce rustdoc quality via lints + CI by @mpiton in #274
• docs(tutorials): add contributor guide for adding languages by @mpiton in #275
• docs: comprehensive architecture guide for contributors (#232) by @mpiton in #276
• chore(release): v1.8.0 + dependabot upgrades by @mpiton in #277

Full Changelog: v1.7.0...v1.8.0

v1.7.0

What's New

Added

• Add support for PEP 735 [dependency-groups] in pyproject.toml — versioned dependencies are parsed, include-group references and unversioned items are skipped (#219)
• Add support for Hatch environment dependencies in pyproject.toml ([tool.hatch.envs.*]) and hatch.toml ([envs.*]), parsing both dependencies and extra-dependencies (#220)

Changed

• Bump sha2 from 0.10 to 0.11 in dependi-zed (digest 0.11 migration)
• Bump actions/configure-pages from v5 to v6 and actions/deploy-pages from v4 to v5 in CI
• Update all Cargo lockfiles with latest compatible dependency versions

Security

• Bump requests from 2.32.4 to 2.33.0 in Python fuzz corpus — insecure temp file reuse in extract_zipped_paths() (#213)

Full Changelog: v1.6.1...v1.7.0

What's Changed

• feat(python): add support for PEP 735 [dependency-groups] by @benediktziegler in #219
• feat(python): add hatch env parsing support by @benediktziegler in #220
• chore(deps): bump requests from 2.32.4 to 2.33.0 in /dependi-lsp/fuzz/corpus/fuzz_python by @dependabot[bot] in #213
• ci: bump actions/configure-pages from 5 to 6 by @dependabot[bot] in #214
• ci: bump actions/deploy-pages from 4 to 5 by @dependabot[bot] in #215
• deps: bump sha2 0.10→0.11 and update all lockfiles by @mpiton in #221
• chore: release v1.7.0 by @mpiton in #222

New Contributors

• @benediktziegler made their first contribution in #219

Full Changelog: v1.6.1...v1.7.0

v1.6.1

Fixed

• Fix false-positive "update available" diagnostic when Cargo.lock contains multiple versions of the same crate (e.g., hashbrown 0.15.5 pulled by a transitive dep and hashbrown 0.16.1 used directly). The root package's dependencies list is now used to select the correct locked version (#210)

Full Changelog: v1.6.0...v1.6.1

What's Changed

• fix: resolve correct version for multi-version crates in Cargo.lock by @mpiton in #211
• chore: release v1.6.1 by @mpiton in #212

Full Changelog: v1.6.0...v1.6.1