What's Changed

• audit now uses native uv audit for uv projects, removing the need to install pip-audit separately (requires uv 0.11.15 or newer)
• audit now uses native yarn npm audit for yarn 4 (Berry) projects; yarn 1 is skipped (incompatible JSON output)
• check and list now use native poetry show for Poetry projects instead of shelling pip through poetry run (requires Poetry 2.2.0 or newer)
• check and list now use native pdm list and pdm outdated for PDM projects instead of shelling pip through pdm run
• check now lists PIE-managed PHP extensions via pie show for accurate detection across all PIE installation methods
• check and fix now report the correct lockfile name for legacy bun projects using bun.lockb
• check now suggests cargo build instead of cargo fetch for missing Rust crates
• Fixed Rust audit severity classification: vulnerabilities now correctly bucket by CVSS score (critical/high/moderate/low) instead of all reporting as info
• Fixed check --outdated and list --outdated counting npm optional dependencies skipped due to platform mismatch
• Fixed check --outdated and list --outdated silently reporting zero outdated packages for bun and yarn projects (neither produces npm-shape JSON for outdated)
• Fixed check --outdated and list --outdated silently swallowing real cargo errors for Rust projects when stdout was empty