Changelog

0.1.0

Initial release.

• Lockfile parsers: requirements.txt (hashes, markers, extras, -r, pip-compile # via), poetry.lock, uv.lock, Pipfile.lock, pdm.lock, package-lock.json v2/v3, yarn.lock v1 and berry, pnpm-lock.yaml (v5/v6/v9), go.mod + go.sum, Cargo.lock; dependency graph with direct/transitive, dev/prod scopes and why paths.
• License detection from site-packages / node_modules / lockfiles, fingerprint-based license text classifier, SPDX expression parser and evaluator, optional PyPI/npm lookup with on-disk cache.
• Policy file (depaudit.toml): license lists, copyleft rules per distribution type, package allow/deny, banned versions, maximum age, vulnerability threshold, hygiene levels; exit codes for CI.
• Offline OSV snapshots (zip / directory / file) with PEP 440, semver and Go pseudo-version range matching, CVSS v3 scoring and minimal upgrade suggestions.
• Hygiene: duplicates, loose specifiers, typosquat heuristic against embedded top-1000 PyPI and npm names.
• CycloneDX 1.5 and SPDX 2.3 JSON SBOMs, validated against the bundled official schemas.
• Table, JSON and Markdown output; why; diff between two JSON reports.