Releases: JacobJoergensen/preflight
Releases · JacobJoergensen/preflight
Release list
2.0.0
2.0.0-beta.2
What's Changed
- Added a
dotnet:script target sopreflight runscripts can target .NET commands - Added
licensessupport for .NET via the optionalnuget-licensetool checknow lists each missing environment variable on its own line instead of a single comma-separated line, so long lists stay readablecheckcard summary line now counts every issue (including each missing item in a grouped list) and reads as a sentence, e.g.Found 4 errors.instead of1 configuration or environment error.checknow flags an installed Ruby that does not satisfy the required version as an error instead of a warning, matching the other ecosystemschecknow reports Node.js 20 and 25 as End-of-Lifecheckno longer misreports PHP as not installed when a failed extension load prints a startup warning, by reading the version from both output streamscheckno longer listsTarget PHP installationas an installed PHP extension when PIE is installedchecknow offers to fix only the ecosystems that failedcheckno longer hangs for seconds on the PHP extension listing when PIE is installedchecknow points topie install-extensions-for-projectfor a missing PHP extension when PIE is availablechecknow wraps long error and warning lines so they stay readable instead of running off the terminalauditnow reports a clear skipped status with an install hint when a lockfile is missing, instead of dumping the raw tool error as a vulnerabilityauditno longer prints raw tool output in the results card
2.0.0-beta.1
What's Changed
- Added .NET (NuGet) ecosystem support:
check,audit,--outdated, andfixfor projects detected via*.csproj/*.fsproj/*.vbproj/*.sln, using the nativedotnetCLI - Added a
licensescommand that checks dependency licenses against an allow/deny policy (licenses.allow/licenses.denyin preflight.yml, or--allow/--deny) across all supported ecosystems (Composer, Rust, JavaScript natively; Go, Python, and Ruby via go-licenses, pip-licenses, and license_finder) auditnow reports individual findings with advisory ID, affected package, severity, and advisory URL instead of only severity counts;audit --jsonadds afindingsarray (schemaVersion 3)auditcan now suppress accepted advisories viaignoredCvesin preflight.yml or the repeatable--ignore-cveflag, matched by CVE/GHSA ID or alias; an ecosystem whose findings are all suppressed passesaudit -o sarifexports findings as SARIF 2.1.0 for upload to GitHub/GitLab code scanning; in SARIF mode findings are reported to code scanning rather than via a non-zero exit, so a later upload step still runs- Release artifacts now ship cosign signatures, SBOMs, and SLSA build provenance, and npm packages are published with provenance, so installs can be verified
checknow offers to runfixwhen it finds missing dependencies in an interactive terminal, via ay/Nprompt that defaults to no (skipped in CI, with--quiet, or-o json)initandhooks installnow prompt to confirm overwriting an existing file in an interactive terminal instead of requiring--force(the--force-or-error behavior is unchanged in CI and non-interactive use)- Added a global
--debugflag that logs each command run, its exit code, and duration (plus stderr on failure) to stderr - Added a global
--cwd/-Cflag to run PreFlight as if started in another directory - Monorepo traversal now recognizes Cargo workspaces and uv (Python) workspaces, alongside npm/yarn/pnpm/bun and Go
- Replaced the per-command
--jsonflag with-o/--format text|json - Replaced the
versioncommand with a--versionflag - Replaced the
--pmand--scopeflags with a single--onlyflag -vis now the shorthand for--verbose; print the version with the long--versionflagcheck --jsonnow reports onemessagesarray per scope with aseverityfield instead of separateerrors/warnings/successesarraysfix --jsonnow emits camelCase keys and aschemaVersion, matchingcheck --jsonandaudit --json- Usage and internal errors now exit with code 2, leaving exit code 1 for findings such as missing dependencies, vulnerabilities, or fix failures
checklists installed dependencies by default and collapses large sections to a count; pass--verboseto list every dependencycheckProject section no longer shows redundant lines: the package manager version (already under Toolchain), static Node scope text, or<file> existsand<manifest> found:confirmationschecknow warns when a project that declares dependencies has no lockfile, since installs are not reproducible without onecheckToolchain line for PHP no longer includes the build date and compiler, only the installed version and required rangefixfailures now report the command and exit code instead of a bareexit status Nhooks installnow writes to the directory fromcore.hooksPathand supports git worktrees, so it works alongside Husky and custom hook setups- Colored output now turns off automatically when output is not a terminal and honors the
NO_COLORandFORCE_COLORenvironment variables checkno longer falsely reports PHP as not installed, or lists a startup warning as an extension, when PHP prints warnings (such as a failed extension load) before its version bannercheck,fix, andauditno longer hang after a timeout or Ctrl-C when a package manager leaves a child process running- Removed the
listcommand - Removed the GitHub update check
- Dropped support for the legacy
bun.lockblockfile; bun projects are detected viabun.lock
1.6.0
What's Changed
- npm package now installs without a postinstall script, fixing installation under pnpm
- Removed winget packaging, which was never published
1.5.0
What's Changed
auditnow uses nativeuv auditfor uv projects, removing the need to installpip-auditseparately (requires uv 0.11.15 or newer)auditnow uses nativeyarn npm auditfor yarn 4 (Berry) projects; yarn 1 is skipped (incompatible JSON output)checkandlistnow use nativepoetry showfor Poetry projects instead of shelling pip throughpoetry run(requires Poetry 2.2.0 or newer)checkandlistnow use nativepdm listandpdm outdatedfor PDM projects instead of shelling pip throughpdm runchecknow lists PIE-managed PHP extensions viapie showfor accurate detection across all PIE installation methodscheckandfixnow report the correct lockfile name for legacy bun projects usingbun.lockbchecknow suggestscargo buildinstead ofcargo fetchfor missing Rust crates- Fixed Rust audit severity classification: vulnerabilities now correctly bucket by CVSS score (critical/high/moderate/low) instead of all reporting as info
- Fixed
check --outdatedandlist --outdatedcounting npm optional dependencies skipped due to platform mismatch - Fixed
check --outdatedandlist --outdatedsilently reporting zero outdated packages for bun and yarn projects (neither produces npm-shape JSON foroutdated) - Fixed
check --outdatedandlist --outdatedsilently swallowing real cargo errors for Rust projects when stdout was empty
1.4.0
What's Changed
- Added Rust ecosystem support:
check,list,audit,fix, andrunnow recognize Cargo projects viaCargo.toml, verify direct and dev dependencies againstCargo.lock, dispatchrust:script targets tocargo, surface outdated crates viacargo outdated(when installed), and run security audits viacargo audit(when installed) listnow splits dev dependencies into their own section under each ecosystem, matching the layout used bychecklistnow shows optional dependencies (optionalDependenciesfor npm,suggestfor Composer, non-dev extras for PEP 621 pyproject.toml,optional = truemarkers for Poetry) in a separate section under each ecosystemchecknow reports npmoptionalDependenciesin a dedicated section and warns when one targeting the host platform is not installed (packages with mismatched OS/CPU tokens in their name are skipped)checknow shows a count of npm optional packages skipped due to platform mismatch under the Optional dependencies sectioncheck --outdatedandlist --outdatednow include outdated optional dependencies for npm and Pythoncheckno longer reports Poetry dependencies markedoptional = trueas missing when not installedchecknow supports Yarn Plug'n'Play projects (yarn berry default): when.pnp.cjsor.pnp.loader.mjsis present, dependency installation status is verified fromyarn.lockinstead of scanningnode_modules/fixnow reports lockfile diffs foryarn.lockalongside the other supported lockfiles- Fixed
checksilently treating missing npm packages and Composer dependencies as installed
1.3.0
What's Changed
- Added a live progress spinner to
checkandaudit - Trimmed PHP toolchain output in
checkto match other ecosystems checknow errors consistently when a required runtime is missinglistnow exits with an error when canceled mid-run
1.2.1
What's Changed
- Rewrote the
versioncommand with a cleaner layout, commit and build date, and a release URL on available updates
1.2.0
What's Changed
- Rewrote the
fixcommand with a redesigned output, interactive per-ecosystem approval, a live progress spinner, and captured tool output surfaced on failure - Added a lock file diff summary to the
fixcommand, rendered by default; use--no-diffto hide it - Added GitHub Actions step summary output:
check,audit, andfixappend a Markdown report to$GITHUB_STEP_SUMMARYwhen the env var is set - Added monorepo support to
check,audit,list, andfix: detects workspace configs (pnpm, npm, go.work) or falls back to scanning for manifests, with--no-monorepoto disable and--projectto filter - Changed fix lock-file backups in monorepo mode: each subproject writes its own
.preflight/backups/<timestamp>/tree; failures in one project no longer abort the rest - Changed
CheckReport(schemaVersion 9) andAuditReport(schemaVersion 2) JSON shapes: items now carry aprojectfield, andCheckReportmoves outdated packages from a top-level map onto each item - Changed
DependencyReport(list command) JSON shape (schemaVersion 1): parallel per-adapter maps replaced by a flatitemsarray with aprojectfield on each entry
1.1.0
What's Changed
- Added
–outdatedflag tocheckandlistcommands to surface packages with available updates - Added
--min-severityflag to theauditcommand - Added
minSeverityconfig option for audit command - Audit output now only includes ecosystems present in the project