# What changed in @mawesome/dependency-audit > 34 changes in @mawesome/dependency-audit 0.2 to 0.4 from its official release notes, upgrade guides and advisories: 5 breaking, 7 new APIs and options. Each one cited. Sources checked 2026-10-20. HTML: https://unstale.sh/npm/@mawesome/dependency-audit/ To see which of these apply to a repository, run `npx @unstale/cli init` in it. ## @mawesome/dependency-audit 0.4 ### Breaking changes - Static imports in .js ESM bundles are scanned even when the package has no "type": "module", so undeclared runtime dependencies are reported. (0.4.6) — [release notes](https://github.com/mawesomedev/mawesome/releases/tag/%40mawesome/dependency-audit%400.4.6) - Stale ignore rules are reported as a red error instead of a warning when this option is used, causing the run to fail. (0.4.2) — [release notes](https://github.com/mawesomedev/mawesome/releases/tag/%40mawesome/dependency-audit%400.4.2) ### New APIs and options - This option turns the warning about ignore rules that matched nothing into a failure. (0.4.0) — [release notes](https://github.com/mawesomedev/mawesome/releases/tag/%40mawesome/dependency-audit%400.4.0) ### Behavior and default changes - Stderr diagnostics are colored to match the rest of the output. (0.4.2) — [release notes](https://github.com/mawesomedev/mawesome/releases/tag/%40mawesome/dependency-audit%400.4.2) - Color is emitted under GitHub Actions so CI logs are readable without scrolling. (0.4.1) — [release notes](https://github.com/mawesomedev/mawesome/releases/tag/%40mawesome/dependency-audit%400.4.1) - The supported Node range widens from >=24.12.0 to ^20.19.0 || >=22.9.0. (0.4.0) — [release notes](https://github.com/mawesomedev/mawesome/releases/tag/%40mawesome/dependency-audit%400.4.0) - A run warns when ignore rules match nothing. (0.4.0) — [release notes](https://github.com/mawesomedev/mawesome/releases/tag/%40mawesome/dependency-audit%400.4.0) ### Tooling - Failing findings are recapped above the summary, so CI logs are readable without scrolling. (0.4.1) — [release notes](https://github.com/mawesomedev/mawesome/releases/tag/%40mawesome/dependency-audit%400.4.1) ### Fixes and other changes - Reports a types-ignored-by-exports notice when a built types or typings field is hidden by exports, instead of the misleading types-not-built notice. (0.4.9) — [release notes](https://github.com/mawesomedev/mawesome/releases/tag/%40mawesome/dependency-audit%400.4.9) - Fixes an out-of-memory crash when auditing a package whose node_modules links into a shared store. (0.4.5) — [release notes](https://github.com/mawesomedev/mawesome/releases/tag/%40mawesome/dependency-audit%400.4.5) - The CLI expands glob targets itself, so patterns work on Windows cmd.exe as they do in a POSIX shell. (0.4.4) — [release notes](https://github.com/mawesomedev/mawesome/releases/tag/%40mawesome/dependency-audit%400.4.4) - The unused-ignore-rule warning is printed at the very end of the report. (0.4.3) — [release notes](https://github.com/mawesomedev/mawesome/releases/tag/%40mawesome/dependency-audit%400.4.3) ## @mawesome/dependency-audit 0.3 ### Breaking changes - Directory audits scan only npm's publish set, so references in files excluded by `npm publish` are not flagged. (0.3.0) — [release notes](https://github.com/mawesomedev/mawesome/releases/tag/%40mawesome/dependency-audit%400.3.0) - Oversized or hostile local tarballs now fail their target instead of being silently treated as an absent dependency. (0.3.0) — [release notes](https://github.com/mawesomedev/mawesome/releases/tag/%40mawesome/dependency-audit%400.3.0) ### New APIs and options - `Finding.causedBy` now includes the producer's package name alongside its target, allowing JSON consumers to correlate producers without parsing the target spec. (0.3.0) — [release notes](https://github.com/mawesomedev/mawesome/releases/tag/%40mawesome/dependency-audit%400.3.0) - In a multi-target run, findings caused by another audited target with a coverage notice are listed muted and counted as collapsed instead of failing the run. (0.3.0) — [release notes](https://github.com/mawesomedev/mawesome/releases/tag/%40mawesome/dependency-audit%400.3.0) - Adds a concurrency option to tune fan-out while transient registry fetches are retried and targets fail if a fetch still cannot be completed. (0.3.0) — [release notes](https://github.com/mawesomedev/mawesome/releases/tag/%40mawesome/dependency-audit%400.3.0) - Ignore rules can be scoped to a `firstSeenIn` glob so a localized suppression does not hide the same specifier elsewhere. (0.3.0) — [release notes](https://github.com/mawesomedev/mawesome/releases/tag/%40mawesome/dependency-audit%400.3.0) - Runtime `unresolved` findings include a reason identifying the cause, including ESM/CJS export-condition mismatches. (0.3.0) — [release notes](https://github.com/mawesomedev/mawesome/releases/tag/%40mawesome/dependency-audit%400.3.0) - Ignore rules can be scoped to a package name or spec so a localized suppression does not hide the same specifier elsewhere. (0.3.0) — [release notes](https://github.com/mawesomedev/mawesome/releases/tag/%40mawesome/dependency-audit%400.3.0) ### Behavior and default changes - Findings caused by another audited target with a coverage notice are annotated with `causedBy`, pointing consumers to the producer to fix. (0.3.0) — [release notes](https://github.com/mawesomedev/mawesome/releases/tag/%40mawesome/dependency-audit%400.3.0) - A missing-types finding is reported as a distinct kind when no `@types/*` companion exists on the registry, avoiding suggestions for nonexistent packages. (0.3.0) — [release notes](https://github.com/mawesomedev/mawesome/releases/tag/%40mawesome/dependency-audit%400.3.0) - When a package has no types or `@types/*` companion but a published version includes types, the finding names that version to suggest a viable dependency. (0.3.0) — [release notes](https://github.com/mawesomedev/mawesome/releases/tag/%40mawesome/dependency-audit%400.3.0) ### Fixes and other changes - The field is attributed only to types appearing solely as synthesized inline imports, so directly imported packages are no longer mislabeled as leaked through a dependency. (0.3.0) — [release notes](https://github.com/mawesomedev/mawesome/releases/tag/%40mawesome/dependency-audit%400.3.0) - Undeclared type findings for types leaking through a declared dependency's API are annotated with the producer dependency, directing the suggestion to the actual fix. (0.3.0) — [release notes](https://github.com/mawesomedev/mawesome/releases/tag/%40mawesome/dependency-audit%400.3.0) - Subpath findings qualify suggestions because the companion or typed version may not declare that exact subpath, and point to a local ambient declaration as fallback. (0.3.0) — [release notes](https://github.com/mawesomedev/mawesome/releases/tag/%40mawesome/dependency-audit%400.3.0) - Fixes false `unresolved` runtime findings for npm-aliased dependencies. (0.3.0) — [release notes](https://github.com/mawesomedev/mawesome/releases/tag/%40mawesome/dependency-audit%400.3.0) - Transient fetches are retried, and a target fails if a fetch still cannot be completed instead of emitting false `undeclared` findings. (0.3.0) — [release notes](https://github.com/mawesomedev/mawesome/releases/tag/%40mawesome/dependency-audit%400.3.0) ## @mawesome/dependency-audit 0.2 ### Breaking changes - The `--json` output is now wrapped in a `{ tool, version, results }` envelope. (0.2.2) — [release notes](https://github.com/mawesomedev/mawesome/releases/tag/%40mawesome/dependency-audit%400.2.2) ### Behavior and default changes - The CLI now prints a dependency-audit version banner. (0.2.2) — [release notes](https://github.com/mawesomedev/mawesome/releases/tag/%40mawesome/dependency-audit%400.2.2) - Shows a live progress indicator on stderr while auditing. (0.2.1) — [release notes](https://github.com/mawesomedev/mawesome/releases/tag/%40mawesome/dependency-audit%400.2.1) - Default CLI output is colorized by severity, except when stdout is not a TTY or --json is used; NO_COLOR and FORCE_COLOR are honored. (0.2.0) — [release notes](https://github.com/mawesomedev/mawesome/releases/tag/%40mawesome/dependency-audit%400.2.0) ### Fixes and other changes - A broken pipe during exit flush, such as piping --json output to head, no longer crashes or hangs the process. (0.2.0) — [release notes](https://github.com/mawesomedev/mawesome/releases/tag/%40mawesome/dependency-audit%400.2.0) - On a late crash or truncating pipe, a stray background rejection is logged rather than fatal, and stdout is flushed first so the run still writes its result. (0.2.0) — [release notes](https://github.com/mawesomedev/mawesome/releases/tag/%40mawesome/dependency-audit%400.2.0)