v0.7.0

Adds first-class support for two Metabase v0.59+ workflows and clears all open dependency advisories.

Added

• question update --db <id> — move a saved card to a different database. Updates both the top-level database_id and dataset_query.database so they never drift.
• --slack-channel <name> on alert create / notification create — post to a Slack channel by name (emits a notification-recipient/raw-value recipient, the only shape v0.59+ accepts for channel-name targets).
• --schedule <cron> (Quartz/Spring), plus legacy --schedule-type / --schedule-hour, on alert create / alert update — schedules now attach to top-level subscriptions[] as notification-subscription/cron.
• notification create: --condition, --send-once, --disable-links flags for the full v0.59+ payload.

Fixed

• --channel-type slack no longer fails with 400 ... unknown error, received: :slack — the channel type is canonicalized to channel/slack / channel/email. Both bare and prefixed forms are accepted.
• notification create --schedule no longer attaches the cron to handlers[].schedule (silently ignored); it's mounted at the notification level.
• AlertApi translates alert_condition + alert_above_goal → send_condition and alert_first_only → send_once; legacy field names still accepted.
• alert create canonicalizes --channel-type before the Slack-recipient guard (prefixed form was bypassing validation).
• alert update --above-goal without --condition now implies a goal condition instead of downgrading to has_result.

Security

• Cleared all npm audit advisories (dev deps): brace-expansion (ReDoS), postcss (XSS), and vitest 3 → 4.1.8 (critical UI-server arbitrary file read/exec). npm audit now reports 0 vulnerabilities. No runtime dependencies changed.

Full Changelog: v0.6.1...v0.7.0