@taiga-ai/mcp-server 0.26.1-dev.543 → 0.26.1-dev.545

package/dist/index.js

@@ -2105,7 +2105,10 @@ const MAINTENANCE_IGNORE_REASONS = [
 *   group is not in the runtime install. Poetry 1.x lockfiles carry no groups
 *   at all, so an empty list says nothing.
 * - uv.lock: only direct members of a group are tagged, so an empty list says
-*   nothing; `dev` means dev.
+*   nothing; `dev` means dev. Where osv-scanner said nothing, the sweep walks
+*   the lockfile's package graph (PRO-2994): a package reachable from any
+*   workspace member's runtime dependencies gets `prod` and reads runtime,
+*   one reachable only from its development groups gets `dev`.
 * - yarn.lock, go.mod/go.sum, Cargo.lock, Gemfile.lock and the rest carry no
 *   group information: unknown whatever the list says.
 *
@@ -2130,7 +2133,9 @@ function lockfileScope(path, groups) {
 		case "pnpm-lock.yaml":
 			if (set.has("prod")) return "runtime";
 			return set.size === 1 && set.has("dev") ? "dev" : "unknown";
-		case "uv.lock": return set.size === 1 && set.has("dev") ? "dev" : "unknown";
+		case "uv.lock":
+			if (set.has("prod")) return "runtime";
+			return set.size === 1 && set.has("dev") ? "dev" : "unknown";
 		case "poetry.lock": return set.size > 0 && !set.has("optional") && !set.has("main") ? "dev" : "unknown";
 		default: return "unknown";
 	}
@@ -3389,6 +3394,7 @@ const PACKAGE_ROW_FIELDS = [
 	"scope",
 	"relation",
 	"introducedBy",
+	"firstParty",
 	"sourcePath",
 	"productRepositoryId",
 	"detectedAt"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@taiga-ai/mcp-server",
-  "version": "0.26.1-dev.543",
+  "version": "0.26.1-dev.545",
   "description": "Taiga for AI coding assistants: read products, policies, initiatives and runs, and operate the line, over MCP",
   "mcpName": "ga.tai/mcp-server",
   "license": "UNLICENSED",