pubguardian 0.1.9

Supply-chain security scanner for Dart and Flutter — CVE, license, and abandoned-package checks with SARIF and CycloneDX output.

Changelog

0.1.9 — 2026-08-02

Changed

• Retargeted pub.dev topics to improve search discovery: security, cve, sbom, supply-chain, cli.

0.1.8 — 2026-08-02

Added

• Official GitHub Action (action.yml) — run scans from a 3-line workflow.
• pre-commit hook (.pre-commit-hooks.yaml) to block commits with vulnerable dependencies.
• Makefile and Dockerfile for make-based workflows and containerised scans.
• README sections documenting the GitHub Action, pre-commit, Docker, and Makefile usage.

0.1.7 — 2026-08-02

Changed

• README now documents cross-platform global bin PATH setup for macOS/Linux (bash/zsh), Windows PowerShell, and Windows cmd.

0.1.6 — 2026-08-02

Changed

• Bumped GitHub Actions to non-deprecated versions in CI and docs: actions/checkout@v5, codecov/codecov-action@v5, actions/upload-artifact@v5, github/codeql-action/upload-sarif@v4.

0.1.5 — 2026-08-02

Fixed

• CVE gate examples (GitHub Actions / GitLab / README) now use --skip-health so the gate fails only on HIGH+ CVEs, not abandoned-package health findings.

0.1.4 — 2026-08-02

Fixed

• Crash on every scan invocation: the help option wasn't registered on the scan subcommand parser. pubguardian scan now works, and scan --help shows the scan usage.
• --version now reports the actual release version.

0.1.3 — 2026-08-02

Fixed

• Replaced outdated Apache-2.0 license text with the exact canonical text so pub.dev's license detection recognizes it.

0.1.2 — 2026-08-02

Fixed

• Restored canonical Apache-2.0 license text so pub.dev recognizes it.
• Shortened pubspec description to satisfy the 180-character limit.

0.1.1 — 2026-08-02

Fixed

• Corrected package repository URL to sonofnos/pubguardian.
• Completed public API documentation for all public members.
• Fixed missing trailing comma in CycloneDX formatter.

0.1.0 — 2026-08-02

Initial release.

Added

• CVE scanning via OSV.dev batch API — batches of 100, exponential-backoff retries, full CVSS severity classification (CRITICAL / HIGH / MEDIUM / LOW / UNKNOWN).
• License compliance — SPDX identifiers from deps.dev API, three policies: commercial (default), strict, permissiveOnly.
• Abandoned and discontinued package detection with configurable threshold.
• Loose version-constraint warnings — any, *, open-ended ranges, pre-1.0 carets.
• Four output formats: text (coloured terminal), json, sarif (SARIF 2.1.0), cyclonedx (CycloneDX 1.6 SBOM). All formats support --output <file>.
• --min-severity, --ignore, --skip-health, --skip-license, --skip-constraints, --exit-zero CLI flags.
• GitHub Actions CI — stable + beta matrix, SARIF upload to GHAS, CycloneDX SBOM artifact, and a strict CVE-gate step.