Release v16.0.1

Adds a "What's New" panel that surfaces on activation, flagging the v16 diagnostic engine change (LSP server replacing the Analyzer Plugin), the new machine health monitoring, and the sidebar redesign — with a one-click revert to the previous engine. log

Added (Extension)

• New "What's New" panel opens on activation, summarizing the v16 diagnostic engine change (Analyzer Plugin → LSP server, on by default), the new machine health monitoring, and the sidebar redesign — with one-click actions including reverting to the Analyzer Plugin, plus a live rule-count stat strip and a discovery grid linking straight into the Findings, Package, and Rules & Tiers dashboards. The panel keeps reappearing on every activation until you scroll through it and uncheck "Show this next time"; reopen it anytime from the Command Palette or Help Hub ("Saropa Lints: What's New"). No action required unless your diagnostics look different after this upgrade, in which case the panel's revert button restores the previous engine.

Added (Lint Rules)

• New always_specify_parameter_names rule (Professional tier) flags call sites passing 2+ consecutive positional arguments of the same or confusable type (e.g. two Strings, int+double), where named arguments could prevent silent swap bugs. Allowlists idiomatic Dart/Flutter constructors like Offset(dx, dy) (matched by declaring library, so a project's own same-named class is never silently exempted); add project-specific allowlist entries under always_specify_parameter_names: allowlist: in analysis_options_custom.yaml.

Fixed (Lint Rules)

• Fixed avoid_unbounded_dependency false positive in Melos/pub-workspace monorepos where a dependency with any constraint is paired with a path: entry in dependency_overrides:. The any is inert in that case because pub resolves via the local path, not the loose constraint. Only path: overrides suppress the lint; git: and hosted: overrides do not.

Improved (Extension)

• "Run analysis" now reads live VS Code diagnostics instead of spawning a cold dart analyze subprocess, completing in milliseconds instead of tens of seconds on large projects. The three analysis paths (full workspace, per-file, and post-config-change) all use the live diagnostic stream. The data written to violations.json is structurally identical to what the Problems panel shows, eliminating stale-data divergence between runs.

Internal

• Fixed the publish workflow authenticating to pub.dev with a stale OIDC token. setup-dart mints the credential once, right after SDK install; Analyze plus the full test suite then run for 9-10 minutes before the publish step, long enough for the short-lived token to expire and be rejected as Invalid JWT token: invalid timestamps. This had been misdiagnosed twice (beta.6, beta.9) as a transient pub.dev outage. setup-dart now re-runs immediately before dart pub publish so the token is minted at the point of use.
• Bumped GitHub Actions across all workflows to Node.js 24-compatible major versions (actions/checkout v4→v5, actions/setup-python v5→v6, actions/setup-node v4→v5 with runtime bumped to Node 22, actions/upload-artifact v4→v5, actions/github-script v7→v8), resolving the Node.js 20 deprecation warning on GitHub-hosted runners.

---