2.0.3

• fix: CLI flags were ignored (kebab-case args now map to camelCase options)
• fix: broken self-check caused by circular require between logic and cliHelpers
• fix(security): remove ReDoS-prone regex in getGitUrl
• fix(security): use execFile to avoid shell injection in e2e test
• fix(security): drop shell when spawning git/npm to prevent command injection from package.json
• fix(security): pass git/npm args after -- to block option injection
• fix: restore --ignore-opt to skip optional dependencies
• test: expand coverage from 68% to 92%
• fix: add newline when writing package.json
• ci: add explicit perms (#5) (#6)

2.0.2

• bump version

2.0.1

• fix: optional dependency support

2.0.0

Release 2.0.0

deps: removed all but semver
deps(semver): updated to v7
deps(concat-stream): refactored it away
deps: replaced bluebird with native promises
deps: dropped jasmine
deps: refactored out spawn-shell
fix: normal log messages to stdout (not stderr)
test: replaced jasmine with node --test
test: added a couple E2E tests
remove package-lock.json from repo