Skip to content

1.4.0

Choose a tag to compare

@github-actions github-actions released this 14 May 10:52

What's Changed

  • Added Rust ecosystem support: check, list, audit, fix, and run now recognize Cargo projects via Cargo.toml, verify direct and dev dependencies against Cargo.lock, dispatch rust: script targets to cargo, surface outdated crates via cargo outdated (when installed), and run security audits via cargo audit (when installed)
  • list now splits dev dependencies into their own section under each ecosystem, matching the layout used by check
  • list now shows optional dependencies (optionalDependencies for npm, suggest for Composer, non-dev extras for PEP 621 pyproject.toml, optional = true markers for Poetry) in a separate section under each ecosystem
  • check now reports npm optionalDependencies in a dedicated section and warns when one targeting the host platform is not installed (packages with mismatched OS/CPU tokens in their name are skipped)
  • check now shows a count of npm optional packages skipped due to platform mismatch under the Optional dependencies section
  • check --outdated and list --outdated now include outdated optional dependencies for npm and Python
  • check no longer reports Poetry dependencies marked optional = true as missing when not installed
  • check now supports Yarn Plug'n'Play projects (yarn berry default): when .pnp.cjs or .pnp.loader.mjs is present, dependency installation status is verified from yarn.lock instead of scanning node_modules/
  • fix now reports lockfile diffs for yarn.lock alongside the other supported lockfiles
  • Fixed check silently treating missing npm packages and Composer dependencies as installed