v0.68.0

What's Changed

• Refresh README benchmarks by @tolgaergin in #383
• Refresh script runner benchmark rows by @tolgaergin in #384
• Add built-in tools benchmark artifact by @tolgaergin in #385
• Cache native dependency lifecycle builds by @tolgaergin in #386
• Ship official Linux x64 musl binaries by @tolgaergin in #387
• Release 0.68.0 by @tolgaergin in #388

Full Changelog: v0.67.0...v0.68.0

What's Changed

• Refresh README benchmarks by @tolgaergin in #383
• Refresh script runner benchmark rows by @tolgaergin in #384
• Add built-in tools benchmark artifact by @tolgaergin in #385
• Cache native dependency lifecycle builds by @tolgaergin in #386
• Ship official Linux x64 musl binaries by @tolgaergin in #387
• Release 0.68.0 by @tolgaergin in #388

Full Changelog: v0.67.0...v0.68.0

What's Changed

• Refresh README benchmarks by @tolgaergin in #383
• Refresh script runner benchmark rows by @tolgaergin in #384
• Add built-in tools benchmark artifact by @tolgaergin in #385
• Cache native dependency lifecycle builds by @tolgaergin in #386
• Ship official Linux x64 musl binaries by @tolgaergin in #387
• Release 0.68.0 by @tolgaergin in #388

Full Changelog: v0.67.0...v0.68.0

v0.67.0

What's Changed

• Add native JSR dependency support by @tolgaergin in #342
• Isolate security approval state in tests by @tolgaergin in #343
• Clean up public repo hygiene by @tolgaergin in #344
• Remove roadmap labels from comments by @tolgaergin in #345
• Clean up test hygiene names by @tolgaergin in #346
• Clean up authorship attribution comments by @tolgaergin in #347
• Remove date-stamped comment metadata by @tolgaergin in #348
• Remove private doc comment references by @tolgaergin in #349
• Remove internal reference comment metadata by @tolgaergin in #350
• Rename stale audit-numbered tests by @tolgaergin in #351
• Include integration tests in release verification by @tolgaergin in #352
• Support Yarn Berry migration by @tolgaergin in #354
• Clean up public hygiene comments by @tolgaergin in #353
• Split lpm-global recovery module by @tolgaergin in #355
• Fix global install recovery race by @tolgaergin in #356
• Decompose config command module by @tolgaergin in #357
• Decompose deploy command module by @tolgaergin in #358
• Decompose v2 store module by @tolgaergin in #359
• Decompose linker v2 module by @tolgaergin in #360
• Decompose CLI args module by @tolgaergin in #361
• Decompose install module helpers by @tolgaergin in #362
• Decompose install phase setup by @tolgaergin in #363
• Decompose install routing setup by @tolgaergin in #364
• Decompose install setup preflight by @tolgaergin in #365
• Decompose install freshness fast path by @tolgaergin in #366
• Decompose install lockfile phases by @tolgaergin in #367
• Decompose install override resolution setup by @tolgaergin in #368
• Extract install link phase by @tolgaergin in #369
• Extract install lockfile write phase by @tolgaergin in #370
• Extract install lifecycle tail phase by @tolgaergin in #371
• Extract install fetch phase by @tolgaergin in #372
• Extract install reporting phase by @tolgaergin in #373
• Extract installer spike metadata resolver module by @tolgaergin in #374
• Extract installer spike parity and metrics by @tolgaergin in #375
• Extract install online resolution phase by @tolgaergin in #376
• Decompose experimental install resolver by @tolgaergin in #377
• Add npm firewall policy controls by @tolgaergin in #378
• Add CI OIDC auth for npm firewall by @tolgaergin in #379
• Add managed firewall protection by @tolgaergin in #380
• Release 0.67.0 by @tolgaergin in #381

Full Changelog: v0.66.0...v0.67.0

v0.66.0

What's Changed

• Fix release artifact downloads without checkout by @tolgaergin in #331
• Skip metadata lookup for canonical lockfile tarballs by @tolgaergin in #332
• Speed up repeat CI installs and source analysis by @tolgaergin in #333
• Include host platform in install hash by @tolgaergin in #334
• Add CLI discovery aliases and license inventory by @tolgaergin in #335
• Add lpm version and release orchestration by @tolgaergin in #336
• Add bare local-bin shorthand by @tolgaergin in #337
• Add run and local-bin benchmark suite by @tolgaergin in #338
• Optimize peer-conflict lockfile scan by @tolgaergin in #339
• Prepare 0.66.0 release by @tolgaergin in #340

Full Changelog: v0.65.0...v0.66.0

v0.65.0

What's Changed

• Remove Node 20 action warnings by @tolgaergin in #319
• Test lpm download case-fold collision rejection by @tolgaergin in #320
• Add install policy extensions by @tolgaergin in #321
• Harden lpm exec TypeScript runtime planning by @tolgaergin in #323
• Add LPM-owned exec TypeScript runtime by @tolgaergin in #324
• Expand lpm exec runtime benchmarks by @tolgaergin in #325
• Add exec runtime competitor and helper overhead benchmarks by @tolgaergin in #326
• Split source execution from local bin exec by @tolgaergin in #327
• Speed up cold TS source runtime IPC by @tolgaergin in #328
• Release 0.65.0 by @tolgaergin in #329

Full Changelog: v0.64.0...v0.65.0

v0.64.0

What's Changed

• Add configurable store integrity mode by @tolgaergin in #314
• Fix v2 integrity policy migration warnings by @tolgaergin in #315
• Harden test-only env knobs in release builds by @tolgaergin in #316
• Add npm firewall entitlement error handling by @tolgaergin in #317
• Release 0.64.0 by @tolgaergin in #318

Full Changelog: v0.63.0...v0.64.0

v0.63.0

What's Changed

• Add lightweight oversized source scanning by @tolgaergin in #259
• Add env-gated install timing detail probes by @tolgaergin in #260
• Fix stale v2 link entries for bin shims by @tolgaergin in #261
• Expose actionable install timing detail by @tolgaergin in #262
• Add warm relink timing instrumentation by @tolgaergin in #263
• Optimize v2 reusable metadata validation by @tolgaergin in #265
• Add cold fetch speculation accounting by @tolgaergin in #266
• Add fetch task trace attribution by @tolgaergin in #267
• Add experimental v2 finalize permit limiter by @tolgaergin in #268
• Add experimental v2 source integrity policy by @tolgaergin in #269
• Add experimental installer graph path by @tolgaergin in #270
• Add trace metadata fetch attribution by @tolgaergin in #271
• Allow live experimental installer benchmarks by @tolgaergin in #272
• Require parity for live installer benchmarks by @tolgaergin in #273
• Harden experimental installer override contract by @tolgaergin in #274
• Admit local sources in installer spike by @tolgaergin in #275
• Preserve optional platform descendants in installer spike by @tolgaergin in #276
• Bound v2 fetch extraction on macOS by @tolgaergin in #277
• Overlap cold fetch with greedy resolution by @tolgaergin in #278
• Harden fetch overlap side effects by @tolgaergin in #279
• Add installer attribution metrics by @tolgaergin in #280
• Instrument direct npm metadata misses by @tolgaergin in #281
• Tune npm metadata fanout for fetch overlap by @tolgaergin in #282
• Reuse fresh v2 object integrity during link populate by @tolgaergin in #283
• Default v2 object integrity to source identity by @tolgaergin in #284
• Attribute v2 link task cost by @tolgaergin in #285
• Overlap experimental installer worklist metadata completion by @tolgaergin in #286
• Trace direct metadata request waves by @tolgaergin in #287
• Trace installer metadata range shapes by @tolgaergin in #288
• Experiment with direct npm exact version docs by @tolgaergin in #289
• Add install readiness benchmark harness by @tolgaergin in #290
• Support patches in installer readiness path by @tolgaergin in #291
• Support top npm readiness sweeps by @tolgaergin in #292
• Fix readiness warning classification by @tolgaergin in #293
• Trace direct npm metadata shape by @tolgaergin in #294
• Add npm provenance publish parity by @tolgaergin in #296
• Add guided config editor by @tolgaergin in #297
• Harden typosquat guard configuration by @tolgaergin in #298
• Add proxy release-age batch hints by @tolgaergin in #299
• Improve proxy batch metadata streaming by @tolgaergin in #300
• Productize npm firewall config by @tolgaergin in #301
• Extend npm firewall to materialization commands by @tolgaergin in #302
• Remove setup proxy mode by @tolgaergin in #303
• Fix npm wrapper binary names by @tolgaergin in #304
• Allow reviewed popular typosquat collisions by @tolgaergin in #305
• Polish whoami and firewall status output by @tolgaergin in #306
• Add npm provenance and workspace frozen coverage by @tolgaergin in #307
• Add JSON schema version and next steps by @tolgaergin in #309
• Make install JSON timing opt-in by @tolgaergin in #310
• Tighten agent JSON next steps by @tolgaergin in #311
• Update lpm init package targeting by @tolgaergin in #312
• Release 0.63.0 by @tolgaergin in #313

Full Changelog: v0.62.0...v0.63.0

v0.62.0

What's Changed

• Respect release-age policy in package selection by @tolgaergin in #222
• Fix audit log and v2 store cleanup races by @tolgaergin in #223
• Add minimum release age excludes by @tolgaergin in #224
• Fix dependency lifecycle builds and npm packument parsing by @tolgaergin in #225
• Fix v2 lifecycle side effects and bin layout by @tolgaergin in #226
• Optimize metadata cache revalidation and speculation payloads by @tolgaergin in #227
• Speed up workspace repeat install fast path by @tolgaergin in #228
• Optimize warm v2 linking and repeat install fast exit by @tolgaergin in #229
• Release download permits before extraction by @tolgaergin in #230
• Offload large metadata JSON parsing by @tolgaergin in #231
• Avoid recreating up-to-date v2 bin shims by @tolgaergin in #232
• Use cli.lpm.dev for schemas and installer docs by @tolgaergin in #233
• Add local install performance harness by @tolgaergin in #234
• Skip unused resolver speculation metadata by @tolgaergin in #235
• Slim speculative metadata payload by @tolgaergin in #236
• Defer stale metadata payload hydration by @tolgaergin in #237
• Parallelize warm v2 cache validation by @tolgaergin in #238
• Keep resolver dependency metadata sparse by @tolgaergin in #239
• Harden npm registry auth routing by @tolgaergin in #240
• Batch Worker-routed metadata roots by @tolgaergin in #241
• Expose metadata HTTP version telemetry by @tolgaergin in #242
• Add live metadata route benchmark by @tolgaergin in #243
• Batch Worker-routed metadata tail misses by @tolgaergin in #244
• Preserve policy metadata after routed full fetch by @tolgaergin in #245
• Add opt-in HTTP/3 metadata transport experiment by @tolgaergin in #246
• Prefer HTTP/3 for LPM worker metadata by @tolgaergin in #248
• Add proxy H3 README benchmark arm by @tolgaergin in #249
• Restore release-age cold install performance by @tolgaergin in #250
• Avoid hashing managed tools on reuse by @tolgaergin in #251
• Restore v2 warm install reuse speed by @tolgaergin in #252
• Add strict release-age policy by @tolgaergin in #253
• Cache compatibility islands in the store for fast warm installs by @tolgaergin in #254
• Defer framework compat island from plain install; add cold-install timing.waterfall by @tolgaergin in #255
• Fix guarded install prompts and store linking regressions by @tolgaergin in #256
• chore: release 0.62.0 by @tolgaergin in #258

Full Changelog: v0.61.0...v0.62.0

v0.61.0

What's Changed

• Fix release auth test isolation by @tolgaergin in #203
• Add full manual release recovery mode by @tolgaergin in #204
• Explain resolver conflicts by @tolgaergin in #205
• Add CWE security matrix coverage by @tolgaergin in #206
• Harden typosquat guard for new dependencies by @tolgaergin in #207
• Harden lpm dlx safety by @tolgaergin in #208
• Add managed tool update UX by @tolgaergin in #209
• Add registry fault workflow harness by @tolgaergin in #211
• Fix v2 workspace linker cycle re-entry by @tolgaergin in #212
• Fix dev compatibility for framework toolchains by @tolgaergin in #213
• Avoid static npmrc credential fixtures by @tolgaergin in #214
• Sign and notarize macOS release binaries by @tolgaergin in #215
• Use stable macOS codesign identifier by @tolgaergin in #216
• Use native macOS Keychain fallback for auth tokens by @tolgaergin in #217
• Use macOS LocalAuthentication for security approvals by @tolgaergin in #218
• Sign Windows release binaries by @tolgaergin in #219
• Use Windows Hello for security approvals by @tolgaergin in #220
• Release 0.61.0 by @tolgaergin in #221

Full Changelog: v0.60.0...v0.61.0

v0.60.0

What's Changed

• Add frozen installs and patch lockfile evidence by @tolgaergin in #198
• Add lpm fetch lockfile store warmer by @tolgaergin in #199
• Add lpm tidy dependency hygiene command by @tolgaergin in #200
• Release 0.60.0 by @tolgaergin in #201

Full Changelog: v0.59.1...v0.60.0

v0.59.1

What's Changed

• Fix wrapper publish smoke recovery by @tolgaergin in #144
• Optimize active install and audit paths by @tolgaergin in #145
• Restore npm native install verifier by @tolgaergin in #146
• Release 0.59.1 by @tolgaergin in #147

Full Changelog: v0.59.0...v0.59.1