@planu/cli 4.1.0 → 4.1.1

package/CHANGELOG.md

@@ -1,3 +1,13 @@
+## [4.1.1] - 2026-05-21
+
+### Features
+- Enforce dependency freshness as a blocking pre-push gate for lockfile drift, high/critical vulnerabilities, and outdated direct dependencies.
+- Add the same pnpm dependency freshness guard to Planu-generated pre-push hooks.
+
+### Tests
+- Add coverage for the dependency freshness script and generated hook contents.
+
+
 ## [4.1.0] - 2026-05-21
 
 ### Features

package/dist/engine/hooks/git-hook-generator.js

@@ -66,6 +66,37 @@ if command -v planu >/dev/null 2>&1; then
   planu detect-drift --project-id "${projectId}" --mode quick 2>/dev/null || true
 fi
 
+if command -v pnpm >/dev/null 2>&1 && [ -f "package.json" ] && [ -f "pnpm-lock.yaml" ]; then
+  echo "[Planu] Checking dependency freshness..."
+  pnpm install --frozen-lockfile --ignore-scripts >/dev/null || {
+    echo "ERROR: package.json and pnpm-lock.yaml are not synchronized."
+    echo "Run: pnpm install --lockfile-only --ignore-scripts"
+    exit 1
+  }
+  pnpm audit --audit-level=high || {
+    echo "ERROR: High or critical dependency vulnerabilities found."
+    echo "Run: pnpm audit and update the affected packages before pushing."
+    exit 1
+  }
+  OUTDATED_JSON="$(mktemp)"
+  OUTDATED_ERR="$(mktemp)"
+  set +e
+  pnpm outdated --format=json >"\${OUTDATED_JSON}" 2>"\${OUTDATED_ERR}"
+  OUTDATED_STATUS=$?
+  set -e
+  if [ "\${OUTDATED_STATUS}" -gt 1 ]; then
+    echo "ERROR: Failed to query dependency freshness from the registry."
+    cat "\${OUTDATED_ERR}"
+    rm -f "\${OUTDATED_JSON}" "\${OUTDATED_ERR}"
+    exit 1
+  fi
+  node -e "const fs=require('fs');const raw=fs.readFileSync(process.argv[1],'utf8').trim();const data=raw?JSON.parse(raw):{};const count=Array.isArray(data)?data.length:Object.keys(data).length;if(count>0){console.error('ERROR: Outdated dependencies found. Run: bash scripts/check-updates.sh --apply, pnpm update, or update intentionally before pushing.');process.exit(1)}" "\${OUTDATED_JSON}" || {
+    rm -f "\${OUTDATED_JSON}" "\${OUTDATED_ERR}"
+    exit 1
+  }
+  rm -f "\${OUTDATED_JSON}" "\${OUTDATED_ERR}"
+fi
+
 echo "[Planu] Pre-push checks complete."
 `;
 }

package/dist/tools/git/hook-ops.js

@@ -165,6 +165,36 @@ function buildPrePushScript(protectedBranches, stalenessThreshold, baseBranch) {
         '  fi',
         'fi',
         '',
+        '# Dependency freshness gate for pnpm projects',
+        'if command -v pnpm >/dev/null 2>&1 && [ -f "package.json" ] && [ -f "pnpm-lock.yaml" ]; then',
+        '  echo "[Planu] Checking dependency freshness..."',
+        '  pnpm install --frozen-lockfile --ignore-scripts >/dev/null || {',
+        '    echo "ERROR: package.json and pnpm-lock.yaml are not synchronized."',
+        '    echo "Run: pnpm install --lockfile-only --ignore-scripts"',
+        '    exit 1',
+        '  }',
+        '  pnpm audit --audit-level=high || {',
+        '    echo "ERROR: High or critical dependency vulnerabilities found."',
+        '    echo "Run: pnpm audit and update the affected packages before pushing."',
+        '    exit 1',
+        '  }',
+        '  OUTDATED_JSON=$(mktemp)',
+        '  OUTDATED_ERR=$(mktemp)',
+        '  pnpm outdated --format=json >"$OUTDATED_JSON" 2>"$OUTDATED_ERR"',
+        '  OUTDATED_STATUS=$?',
+        '  if [ "$OUTDATED_STATUS" -gt 1 ]; then',
+        '    echo "ERROR: Failed to query dependency freshness from the registry."',
+        '    cat "$OUTDATED_ERR"',
+        '    rm -f "$OUTDATED_JSON" "$OUTDATED_ERR"',
+        '    exit 1',
+        '  fi',
+        "  node -e \"const fs=require('fs');const raw=fs.readFileSync(process.argv[1],'utf8').trim();const data=raw?JSON.parse(raw):{};const count=Array.isArray(data)?data.length:Object.keys(data).length;if(count>0){console.error('ERROR: Outdated dependencies found. Run: bash scripts/check-updates.sh --apply, pnpm update, or update intentionally before pushing.');process.exit(1)}\" \"$OUTDATED_JSON\" || {",
+        '    rm -f "$OUTDATED_JSON" "$OUTDATED_ERR"',
+        '    exit 1',
+        '  }',
+        '  rm -f "$OUTDATED_JSON" "$OUTDATED_ERR"',
+        'fi',
+        '',
         'exit 0',
     ].join('\n');
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@planu/cli",
-  "version": "4.1.0",
+  "version": "4.1.1",
   "description": "Planu — MCP Server for Spec Driven Development with native Rust acceleration for hot paths. Cross-platform (Linux/macOS/Windows, x64/arm64, glibc/musl).",
   "type": "module",
   "main": "dist/index.js",
@@ -32,12 +32,12 @@
     "packageName": "@planu/core"
   },
   "optionalDependencies": {
-    "@planu/core-darwin-arm64": "4.1.0",
-    "@planu/core-darwin-x64": "4.1.0",
-    "@planu/core-linux-arm64-gnu": "4.1.0",
-    "@planu/core-linux-arm64-musl": "4.1.0",
-    "@planu/core-linux-x64-gnu": "4.1.0",
-    "@planu/core-linux-x64-musl": "4.1.0"
+    "@planu/core-darwin-arm64": "4.1.1",
+    "@planu/core-darwin-x64": "4.1.1",
+    "@planu/core-linux-arm64-gnu": "4.1.1",
+    "@planu/core-linux-arm64-musl": "4.1.1",
+    "@planu/core-linux-x64-gnu": "4.1.1",
+    "@planu/core-linux-x64-musl": "4.1.1"
   },
   "engines": {
     "node": ">=24.0.0"
@@ -68,6 +68,7 @@
     "test:integration": "vitest run tests/integration",
     "check": "pnpm typecheck && pnpm lint && pnpm format:check",
     "check:strict": "pnpm typecheck && pnpm lint && pnpm format:check && pnpm audit:deadcode && pnpm audit:circular && pnpm audit:types && pnpm audit:security && pnpm audit:licenses && pnpm audit:i18n",
+    "check:deps:fresh": "bash scripts/check-dependency-freshness.sh",
     "audit:deadcode": "knip",
     "audit:circular": "madge --circular --extensions ts src/",
     "audit:types": "type-coverage --at-least 98 --ignore-catch --strict --ignore-files 'tests/**'",