npm / @mawesome/dependency-audit

@mawesome/dependency-audit

What changed in @mawesome/dependency-audit 0.2 to 0.4, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-20.

5 breaking7 new APIs and options10 behavior and defaults1 tooling11 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@mawesome/dependency-audit 0.412 changes

Static imports in .js ESM bundles are scanned even when the package has no "type": "module", so undeclared runtime dependencies are reported.
0.4.6release notes
Stale ignore rules are reported as a red error instead of a warning when this option is used, causing the run to fail.
0.4.2release notes

This option turns the warning about ignore rules that matched nothing into a failure.
0.4.0release notes

Stderr diagnostics are colored to match the rest of the output.
0.4.2release notes
Color is emitted under GitHub Actions so CI logs are readable without scrolling.
0.4.1release notes
The supported Node range widens from >=24.12.0 to ^20.19.0 || >=22.9.0.
0.4.0release notes
A run warns when ignore rules match nothing.
0.4.0release notes

Failing findings are recapped above the summary, so CI logs are readable without scrolling.
0.4.1release notes

Reports a types-ignored-by-exports notice when a built types or typings field is hidden by exports, instead of the misleading types-not-built notice.
0.4.9release notes
Fixes an out-of-memory crash when auditing a package whose node_modules links into a shared store.
0.4.5release notes
The CLI expands glob targets itself, so patterns work on Windows cmd.exe as they do in a POSIX shell.
0.4.4release notes
The unused-ignore-rule warning is printed at the very end of the report.
0.4.3release notes

Directory audits scan only npm's publish set, so references in files excluded by npm publish are not flagged.
0.3.0release notes
Oversized or hostile local tarballs now fail their target instead of being silently treated as an absent dependency.
0.3.0release notes

Finding.causedBy now includes the producer's package name alongside its target, allowing JSON consumers to correlate producers without parsing the target spec.
0.3.0release notes
In a multi-target run, findings caused by another audited target with a coverage notice are listed muted and counted as collapsed instead of failing the run.
0.3.0release notes
Adds a concurrency option to tune fan-out while transient registry fetches are retried and targets fail if a fetch still cannot be completed.
0.3.0release notes
Ignore rules can be scoped to a firstSeenIn glob so a localized suppression does not hide the same specifier elsewhere.
0.3.0release notes
Runtime unresolved findings include a reason identifying the cause, including ESM/CJS export-condition mismatches.
0.3.0release notes
Ignore rules can be scoped to a package name or spec so a localized suppression does not hide the same specifier elsewhere.
0.3.0release notes

Findings caused by another audited target with a coverage notice are annotated with causedBy, pointing consumers to the producer to fix.
0.3.0release notes
A missing-types finding is reported as a distinct kind when no @types/* companion exists on the registry, avoiding suggestions for nonexistent packages.
0.3.0release notes
When a package has no types or @types/* companion but a published version includes types, the finding names that version to suggest a viable dependency.
0.3.0release notes

The field is attributed only to types appearing solely as synthesized inline imports, so directly imported packages are no longer mislabeled as leaked through a dependency.
0.3.0release notes
Undeclared type findings for types leaking through a declared dependency's API are annotated with the producer dependency, directing the suggestion to the actual fix.
0.3.0release notes
Subpath findings qualify suggestions because the companion or typed version may not declare that exact subpath, and point to a local ambient declaration as fallback.
0.3.0release notes
Fixes false unresolved runtime findings for npm-aliased dependencies.
0.3.0release notes
Transient fetches are retried, and a target fails if a fetch still cannot be completed instead of emitting false undeclared findings.
0.3.0release notes

The --json output is now wrapped in a { tool, version, results } envelope.
0.2.2release notes

The CLI now prints a dependency-audit version banner.
0.2.2release notes
Shows a live progress indicator on stderr while auditing.
0.2.1release notes
Default CLI output is colorized by severity, except when stdout is not a TTY or --json is used; NO_COLOR and FORCE_COLOR are honored.
0.2.0release notes

A broken pipe during exit flush, such as piping --json output to head, no longer crashes or hangs the process.
0.2.0release notes
On a late crash or truncating pipe, a stray background rejection is logged rather than fatal, and stdout is flushed first so the run still writes its result.
0.2.0release notes