arch_guard 1.10.0

A CLI tool and Dart library for static architecture analysis, Clean Architecture layer governance, circular dependency metrics, and graph visualization.

1.10.0

• Layer rules see through barrels. When a layered file imports a file in no layer that re-exports another layer (lib/exports.dart with export 'data/dto.dart';), the import is now checked against what the barrel re-exports. Chains of such barrels are followed. Before, the barrel was skipped, so domain -> exports.dart -> data passed. The violation reads ... -> [data] lib/data/dto.dart (via lib/exports.dart). With --since, a change to the barrel also reports it. Library: LayerViolation.via, viaSuffix; LayerValidator.checker takes via.
• Platform-specific cycles. A cycle that exists only through conditional imports is now marked Platform-specific (only through conditional imports: if (dart.library.io)) in the terminal, Markdown, SARIF and JSON (platformConditions). It still counts as a cycle. Edges from conditional imports carry their condition in the JSON export. Library: GraphEdge.condition, ExtractedDirective.condition, Cycle.platformConditions, isPlatformSpecific, platformNote.

1.9.2

• Baseline flags improvements to lock in. A known cycle group that lost files or split, or a known metric value that dropped, is now reported as N cycle group(s) shrank / N metric value(s) dropped since the baseline. Run with --update-baseline to lock this in. in the terminal and Markdown report. Before, only problems that disappeared entirely were reported, so a shrunk cycle could quietly grow back to its saved size. Library: BaselineComparison.shrunkCycleCount, improvedMetricCount, improvements.
• Docs: updating the baseline is manual; "no regression" is measured against the saved baseline, not the last passing run.

1.9.1

• Baseline says why a cycle is new. Each new cycle in the terminal and Markdown report now ends with a reason: grew from a known 3-file cycle, adding lib/d.dart, merges 2 known cycles, or none of its files is in a baseline cycle. Library: BaselineComparison.newCycleReasons.
• Docs: the cycle rule is spelled out. The baseline compares cycle membership, not the imports inside a cycle. With a baseline cycle a -> b -> c -> a, adding a -> c still passes. A test pins this down.

1.9.0

• init handles hybrid layouts. When it picks riverpod or clean_architecture and also finds bloc/ or cubit/ folders, the generated config adds a bloc layer that may import what presentation may, and lets presentation import it. A bloc that imports UI code is still a violation. Library: LayoutDetection.blocFolders.

1.8.0

• New: ProjectScanner.scanSources(). Builds a ScanResult from in-memory file contents instead of the file system. The arch_guard_lint 0.2.0 plugin uses it for live cycle warnings that include unsaved editor changes.

1.7.1

• --since output:
  • The "Only problems touching N file(s)…" note now comes before the report, so "No circular dependencies found!" reads as "none in the changed files".
  • N counts only scanned files (not pubspec.yaml, assets…). ArchAnalysis.changedFiles itself now holds only scanned files too, so deleted and non-Dart files are no longer in it. Filtering is unchanged.
• JSON export: with --since, the export now records since and changedFiles.
• Errors and warnings:
  • With git older than 2.30, --since now says it needs git 2.30+ instead of showing git's raw error.
  • --no-workspace with workspace_rules now says the rules are ignored because of the flag, not that the project isn't a workspace.
• Cycle hints: when two files are joined by both an import and an export, the hint points at the first of those lines.
• metrics: hotspots alone: a config with only hotspots (no limits) now lists the most coupled files in the terminal. New: ArchGuardConfig.metricsConfigured.
• workspace_rules: a rule whose allowed entries are all invalid globs is now skipped with a warning, so that member is unrestricted until the globs are fixed. Before, it silently forbade every import. An explicit allowed: [] still means "no other members".
• Unreadable files: warnings about files that couldn't be read are listed in a stable order.

1.7.0

• New: cycle-breaking hints. Each circular-dependency group now names the one import whose removal breaks it (or shrinks it most), in the terminal, Markdown, SARIF and JSON (scc.suggestedBreak). Library: CycleBreaker, CycleBreak.
• New: --since <git-ref>. Reports (and fails on) only problems touching files changed since the merge base with a ref, plus uncommitted and untracked files, while still analysing the whole project. Baseline "fixed" counts stay accurate. Also available as expectArchitecture(since:) and ArchAnalysis.run(since:). Needs full history in CI (fetch-depth: 0).
• Docs: an example project for every feature. example/example.md (pub.dev's Example tab) links to small projects in example/cases/: cycles, layers, presets, forbidden packages, metrics, workspace rules, baselines, --since, architecture tests and reports. Each README has the config, the command and its real output. example/example.dart covers the library API. The CLI and testing docs gain --since and cycle-fix recipes.

1.6.0

• New: metric limits. metrics: max_fan_out / max_fan_in fail the run when a file imports, or is imported by, too many project files. Baselines ratchet: a known file that gets worse fails again. Reports list the most coupled files (hotspots, default 10) in Markdown and JSON, and in the terminal when limits are set. SARIF rule metric-limit. Library: FileMetrics, MetricValidator.
• New: workspace_rules. In a Dart workspace or packages//apps/ monorepo, declare which members may import which (apps/* → packages/*, never the reverse). Violations point at the import line, fail the run, and work with baselines, SARIF (workspace-dependency), Markdown and JSON. Library: WorkspaceValidator, WorkspaceViolation, ScanResult.packages.
• Fixed: unstable cycle order. Files and edges are now sorted, so cycle numbering and every report are identical between runs.
• Baseline files gain metricViolations and workspaceViolations lists. Older baselines still load.

1.5.0

• New: forbidden_packages. Rule out packages and core libraries for the whole project (top-level key) or per layer (e.g. domain may not import flutter or dart:io). Entries are package names or globs (firebase_*). Violations fail the run, point at the import line, and work with baselines, SARIF (forbidden-package rule), Markdown and JSON reports.
• Library: PackageValidator, PackageViolation, PackageImport and ScanResult.packageImports; LayerValidator.layerResolver() is now public.
• Baseline files gain a packageViolations list. Older baselines still load.
• Invalid globs in arch_guard.yaml (ignore, layer patterns, forbidden_packages) are reported as warnings and skipped instead of crashing the run. defaultExcludePatterns is now exported.
• New: expectArchitecture() in package:arch_guard/testing.dart runs the same checks as the CLI inside dart test / flutter test and fails with a readable list of problems. Works with any test runner; no extra dependencies.
• Library: ArchAnalysis.run() runs a full analysis (scan, cycles, layer and package rules, baseline) in one call; the CLI now uses it.
• Library: ArchGuardConfig.loadWith() loads configuration through a custom file reader, and LayerValidator.checker() checks a single import. Both are used by the new arch_guard_lint analyzer plugin.

1.4.1

• Fixed: empty graph in the HTML report. The page layout could let the graph canvas grow taller than the window, drawing the nodes out of view. The report header now says arch_guard instead of the old "Dependency Graph Visualizer" name.
• New: documentation site at creatorpiyush.github.io/arch_guard, with a recipe per preset, the configuration reference, CI and git hook guides, and the CLI reference. The README is shorter, with screenshots and a comparison with similar tools.
• Every public API member now has a doc comment, and pubspec.yaml links the documentation and issue tracker.
• Contributor guide, security policy, and issue and pull request templates.

1.4.0

• New: arch_guard init. Detects the project layout (Clean Architecture, Riverpod, Bloc or feature-first folders), writes a starter arch_guard.yaml, and previews the first scan: files per layer, violations, cycles, and the suggested next step. Options: --preset <name|auto|none>, --dry-run, --force.
• New: Layer presets. preset: clean_architecture | feature_first | bloc | riverpod in the config expands to predefined layers. Entries under layers: override a preset layer key by key (for example only allowed_imports) or add new layers. feature_first discovers features from lib/features/* (or lib/modules/*) on every run, so each feature may import only itself and shared code.
• Improved: Actionable layer violations. Each violation now shows the rule it broke (Rule: `presentation` may only import `core`, `domain`, `presentation`.) and the output ends with how to fix it. SARIF and Markdown reports include the rule too; LayerViolation gains allowedImports, rule and suggestion, and the JSON report includes allowedImports.
• Preset layers that match no files no longer produce "matched no scanned files" warnings.
• Library: ArchGuardConfig.parse() reads configuration from a string; LayerCoverage.layerFileCounts counts files per layer; LayerPresets and LayoutDetector are exported.
• A bad option to arch_guard init now prints the init usage instead of the main one.

1.3.0

• New: Baselines for legacy projects. --update-baseline records today's circular dependencies and layer violations in arch_guard_baseline.json. When that file exists, later runs fail only on new problems: a known cycle may shrink, but one that grows or merges with another counts as new. Fixed entries are reported so the baseline can be tightened. Use --baseline <path> for a different location. Library users get Baseline and BaselineComparison.
• New: SARIF output (-f sarif) writes arch_guard.sarif (SARIF 2.1.0) for GitHub Code Scanning, Azure DevOps and SARIF viewers in IDEs. Results point at the offending import line, use paths relative to the git repository root, and carry baselineState when a baseline is in use.
• New: Markdown summary (-f markdown) writes arch_guard_report.md: new problems first, then a collapsible Mermaid graph of the cycles. Ready for PR comments and CI job summaries.
• New: GitHub Action. uses: creatorpiyush/arch_guard@v1.3.0 downloads the checksum-verified release binary, writes the Markdown summary to the job summary, keeps one up-to-date PR comment, and can upload SARIF to Code Scanning.
• New: pre-commit hook. The repository ships a .pre-commit-hooks.yaml, and the README has recipes for pre-commit, lefthook and plain git hooks.
• New: --version flag and the packageVersion constant.
• Layer violations, graph edges and directives now record the source line (LayerViolation.line, GraphEdge.line, ExtractedDirective.line); the JSON report includes it.
• -f all now also writes the SARIF and Markdown reports.
• Local-only files (plan.md, IDE files, build/) are no longer included in the published package.

1.2.1

• Wider compatibility: minimum Dart SDK lowered from 3.11 to 3.8 (Flutter 3.32+), so projects on older toolchains can add arch_guard as a dev dependency.
• New: Standalone binaries: every GitHub Release now includes prebuilt executables for Linux (x64, arm64), macOS (Apple Silicon) and Windows (x64) plus a SHA256SUMS.txt, so CI pipelines can run arch_guard without installing the Dart SDK.
• CI: Tests run on Linux, macOS and Windows against both the minimum supported SDK (3.8) and the latest stable SDK.
• Fix: Publish workflow ran twice per release: publishing to pub.dev is now triggered by version tags only.
• Removed the Flutter .metadata file from the repository.

1.2.0

• Fix: --scan-dir was ignored whenever workspace discovery was on (the default). A single-package project is no longer treated as a workspace, and in workspace mode the root package honours --scan-dir.
• Fix: Over-eager workspace auto-discovery: without a workspace: list, only packages/ and apps/ are searched, and example/, test/ and tool/ packages are skipped. Previously example/ apps and test fixtures were scanned and could report false cycles. Monorepos with other layouts should declare a workspace: list.
• Fix: Phantom graph nodes: edges are only kept when their target file was actually scanned.
• New: max_scc_size is enforced: any circular-dependency group larger than the limit fails the run (exit code 1), even with --no-fail-on-cycle.
• New: Configuration warnings: unparseable YAML, unknown keys, wrongly typed values, allowed_imports naming unknown layers, layers that match no files, files that belong to no layer, and unreadable source files are now reported on stderr instead of being silently ignored. LayerValidator.coverage(), ArchGuardConfig.warnings and ScanResult.skippedFiles expose the same data to library users.
• New: part directives produce library -> part edges (type part, drawn dotted in DOT/Mermaid/HTML); FileNode.parts lists them.
• Improved: Directive parser now reads the directive section token by token, so // or /* inside URIs or comments, nested block comments, annotations and import-like text inside later string literals no longer cause wrong results.
• Security: HTML report escapes file paths before inserting them into the page and escapes <, > and & in the embedded JSON.
• Rename: DepGraphConfig is now ArchGuardConfig (the old name remains as a deprecated alias). The legacy dep_graph.yaml file and dep_graph_visualizer: pubspec key still work but emit a deprecation warning; the example now uses arch_guard.yaml.
• Tests write CLI output to a temporary directory instead of example/sample_project/build/.

1.1.3

• Fix: Layer validator now works correctly in workspace/monorepo mode (LayerValidator): Layer glob patterns such as lib/domain/** were silently never matching workspace-prefixed file paths (e.g. packages/auth_pkg/lib/domain/entity.dart). The validator now also tests the lib/… suffix of each path, making single-package and workspace arch_guard.yaml configs interchangeable with no user-side changes required.
• Fix: Cross-package edge resolution path separator on Windows (ImportReader.resolveUri): p.normalize(p.join(…)) could produce backslash-separated paths on Windows, causing all resolved edge targets to silently miss the forward-slash-keyed filesMap and disappear from the graph. All three return paths now force / separators.
• Fix: Missing space in workspace summary line (TextReporter): The Workspace Pkgs: line was missing a space before the count, producing misaligned output (e.g. Workspace Pkgs:3 instead of Workspace Pkgs: 3).

1.1.2

• True --offline HTML Support: Inlined Base64-encoded vis-network.min.js (v10.1.0 UMD) asset and system font fallbacks when --offline flag is specified.
• Physics Stabilization Freeze: Added stabilizationIterationsDone event listener to freeze Vis-Network force calculation after stabilization to eliminate CPU background spin.
• Mermaid Exporter Disambiguation: Added shared ID map with numeric suffix disambiguation for colliding file paths (e.g. a-b.dart vs a_b.dart) and quote label sanitization (#quot;).
• Attribution & Notices: Added THIRD_PARTY_NOTICES.md for bundled vis-network Apache-2.0/MIT software licensing.

1.1.1

• Refined dep_graph.yaml configuration examples and updated example application layout.
• Cleaned up maintainer CI documentation in README.md.

1.1.0

• Strongly Connected Component (SCC) Severity Metrics: Calculate internal edges, average fan-in, average fan-out, instability metric ($I$), graph coupling density ($D$), and bottleneck dependency hub files (SccComponent).
• Clean Architecture & Layer Boundary Checker: Configurable layer rules in dep_graph.yaml or pubspec.yaml with glob pattern matching (LayerValidator).
• Targeted File Dependency Explainer: Detailed file-level dependency path and cycle analysis via --explain <file>.
• New Export Formats: Machine-readable JSON report (JsonExporter) and GitHub/GitLab markdown flowchart diagram export (MermaidExporter).
• High-Throughput Parallel Scanning: Bounded parallel file reader queue (batch size 64) in ProjectScanner.
• Scope & Offline Control: Added --scope cycles|all graph scope trimming and --offline HTML asset inlining.

1.0.1

• Updated License to MIT

1.0.0

• Initial release of dep_graph_visualizer.
• Monorepo & Dart 3.6+ Workspace auto-discovery (pubspec.yaml workspace: entries and Melos sub-package structures).
• Cross-package import resolution (package:<member_pkg>/...) and inter-package circular dependency detection.
• Project scanner with regex directive parser.
• Circular dependency detector using Tarjan's SCC algorithm.
• Terminal text reporter with ANSI colors.
• Graphviz .dot exporter.
• Interactive single-file centerpiece HTML graph visualizer.
• Full CLI supporting repeatable -f, -o, --scan-dir, --exclude, and --[no-]workspace flags.
• Added conditional import/export support by treating every quoted URI in a directive as a potential dependency edge.
• Added a Flutter-style fixture and tests covering circular dependency detection through conditional imports.