0.5.0

Dependency Checker 0.5.0 expands the evidence available to the check-dependencies Agent Skill, CLI, and MCP server. It keeps repository analysis static and makes additional analyses explicit operations with selected inputs.

What changed

• More ecosystem evidence. Cargo manifests and locks, conditional Rust crate references, CMake configuration and supplied File API models, and literal Bzlmod declarations now have dedicated evidence scopes. Existing collectors retain more Python group/workspace context, Maven plugin and Gradle catalog assertions, Go tool configuration, C/C++ conditions, and frontend script/style imports.
• Python metadata backtracking. Compatibility analysis uses bounded resolvelib backtracking, including extras, Requires-Python and explicitly selected development or optional groups. PEP 723 scripts have independent ownership. Missing metadata, unknown markers and exhausted budgets remain incomplete.
• Vulnerability matching and external reports. Offline OSV reevaluation separates affected-version matching from fix candidates. Alias grouping, advisory revisions, withdrawals, source-qualified identities and CVE/CWE provenance retain their context. Separate inspectors accept supplied CVE/CWE, OpenVEX, attestations, govulncheck, call, runtime, component, and ABI evidence.
• 18 MCP tools. New operations cover selected-source Python calls, comparisons of inventories and package scripts, explicit public-registry checks, and unsigned provenance or policy exports. SBOM inspection retains additional identity and field-quality assertions; SARIF preserves Unicode locations and qualified notebook coordinates.
• Safer evidence handling. Bounded file reads and in-memory default SQLite work protect read-only queries from repository-controlled links and temporary paths. Static command/configuration evidence stays separate from imports and actual execution.

Upgrading

Download dependency-checker-0.5.0.zip, verify it against SHA256SUMS, and keep the whole Skill directory, including references/. From the extracted bundle, run:

uv sync --frozen --extra agent
uv run --frozen --extra agent depcheck --version

Python 3.11 or newer and uv 0.12.4 are required. Rebuild old evidence caches with depcheck index .; this release uses analysis revision 57 and index schema v4. If Python component IDs changed, migrate scoped mappings and tool-usage entries to the returned owners before rebuilding. Upgrade the Skill and backend together.

Scans do not execute target code or package managers. Imported assertions, candidate call paths and registry existence do not establish installation, exploitation, or package safety. MCP scans remain offline; separate network checks require explicit selection.

Verification

All six CI jobs passed for release commit d7e7420: Python 3.11/3.12 tests, quality checks, and Ubuntu/macOS/Windows builds with native boundary and installed-wheel checks. Local checks also covered a base-wheel installation, the locked Skill bundle installation, and 69 offline MCP contract scenarios with 151 scripted tool calls. These contract checks are separate from model-agent behavior evaluation.