@merupatel/reachable 1.0.3 → 1.0.5

package/CHANGELOG.md

@@ -1,3 +1,17 @@
+## [1.0.5](https://github.com/Meru143/reachable/compare/v1.0.4...v1.0.5) (2026-03-20)
+
+
+### Bug Fixes
+
+* add cli demo and resolve wildcard aliases ([5c6a62d](https://github.com/Meru143/reachable/commit/5c6a62d2b191d9c78cfd1ad18253c977d82b76a8))
+
+## [1.0.4](https://github.com/Meru143/reachable/compare/v1.0.3...v1.0.4) (2026-03-20)
+
+
+### Bug Fixes
+
+* build package before pack and publish ([6e35eea](https://github.com/Meru143/reachable/commit/6e35eeac938166ddbafbc33bae0f1b1767abedf2))
+
 ## [1.0.3](https://github.com/Meru143/reachable/compare/v1.0.2...v1.0.3) (2026-03-19)
 
 

package/README.md

@@ -4,10 +4,16 @@
 ![npm](https://img.shields.io/npm/v/%40merupatel%2Freachable)
 ![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)
 
-`reachable` is a local-first CLI that answers the question developers ask after `npm audit`: is the vulnerable code path actually reachable from my application?
+`reachable` is a local-first CLI for JavaScript and TypeScript that answers the question developers ask after `npm audit`: is the vulnerable code path actually reachable from my application?
 
 It parses JavaScript and TypeScript with tree-sitter, builds a project call graph, queries OSV advisories, and reports whether the vulnerable symbol is reachable, unknown, or unreachable from your entry points.
 
+![reachable CLI demo](docs/assets/reachable-demo.gif)
+
+- Cut false-positive dependency noise by separating `REACHABLE`, `UNKNOWN`, and `UNREACHABLE` findings.
+- Fail CI on code paths that actually matter instead of every advisory in the lockfile.
+- Run locally or in GitHub Actions without a hosted service, account, or API key.
+
 ## Why reachable?
 
 `npm audit` reports package-level risk. It does not know whether your code imports or calls the vulnerable function. That leads to noisy CI failures, broad dependency upgrade churn, and teams ignoring entire audit reports.
@@ -18,6 +24,14 @@ It parses JavaScript and TypeScript with tree-sitter, builds a project call grap
 - It separates `REACHABLE`, `UNKNOWN`, and `UNREACHABLE` findings so real risk rises to the top.
 - It works locally in CI without a hosted service, account, or API key.
 
+## Why Not Just `npm audit`?
+
+| Tool | Flags vulnerable packages | Checks whether your code reaches the vulnerable symbol | Local-first CLI |
+| --- | --- | --- | --- |
+| `reachable` | Yes | Yes | Yes |
+| `npm audit` | Yes | No | Yes |
+| Dependabot alerts | Yes | No | No |
+
 ## Installation
 
 ```bash

package/dist/cli/index.d.cts

@@ -0,0 +1,6 @@
+#!/usr/bin/env node
+import { Command } from 'commander';
+
+declare const program: Command;
+
+export { program };