v0.10.0 - Reach

The "Reach" release: SvelteKit and React Router/Remix get API Health analysis, Next.js middleware is judged for each route the way it runs, tRPC perimeters cover Hono, Fastify, and Auth.js, pnpm workspaces stop reporting each other's vulnerabilities, and password and secret checks stop flagging ordinary sign-up code.

npx @sabahattink/codediag@0.10.0 scan .

Highlights

• SvelteKit: +server endpoints and form actions, with auth in the handle hook or the handler. CodeDiag says so when the only auth check sits in a layout load, which never runs for actions. It also flags missing body validation and disabled CSRF origin checks.
• React Router and Remix: actions and loaders from app/routes.ts or flat-route files, with route middleware as a perimeter. A separate rule covers auth that only lives in a parent's or the route's own loader, since neither runs before an action.
• Next.js middleware, run per route: a guard for /dashboard no longer protects /api, and clerkMiddleware() alone no longer counts as auth. Auth.js authorized callbacks and Supabase's updateSession() are understood.
• tRPC perimeters: auth before Hono's trpcServer(), auth hooks over Fastify's tRPC plugin, and Auth.js v5 middleware.
• One pnpm audit per workspace: each package reports only the advisories its own dependencies reach.
• Fewer false positives: sign-up validation, error messages, test fixtures, Pwned Passwords lookups, and MOCK_ placeholders are no longer critical findings. On the Remix indie-stack, Security goes from 3 to 78; on the Epic Stack, from 0 to 72.
• VS Code 0.8.0 runs the new engine.

This release also ships 0.9 "Perimeter", which was not published on its own:

• tRPC auth in createContext, Express mounts, and Next.js middleware;
• dependency audits cached for an hour and run concurrently across workspace packages;
• Dependabot updates that rebuild the Action bundle.

See the changelog for details.