activate-agentmd 2.4.0 → 2.5.0

package/src/lib/patterns.js

@@ -26,12 +26,6 @@ const PATTERNS = [
     test: /\bSELECT\s+\*\s+FROM\b/i,
     message: "`SELECT *` — name the columns you need.",
   },
-  {
-    id: "pydantic-v1-api", standard: "Backend/pydantic", severity: "medium", files: [".py"],
-    test: /\.(dict|json|parse_obj|parse_raw)\(|@(validator|root_validator)\b|class Config:/,
-    not: /model_dump|model_validate/,
-    message: "Pydantic v1 API (`.dict()`, `.json()`, `@validator`, `class Config`) — use `model_dump`, `model_validate`, `field_validator`, `ConfigDict`.",
-  },
   {
     id: "eval-exec", standard: "Security/command-injection", severity: "high",
     files: [".js", ".ts", ".tsx", ".py", ".rb", ".php"],
@@ -82,11 +76,6 @@ const PATTERNS = [
     not: /process\.env|os\.environ|getenv|\$\{|<[A-Z_]+>|example|placeholder|changeme|xxx/i,
     message: "Looks like a hard-coded secret — read it from the environment or a secret store.",
   },
-  {
-    id: "next-sync-request-api", standard: "Frontend/nextjs", severity: "medium", files: [".ts", ".tsx"],
-    test: /\b(cookies|headers)\(\)\.(get|set|getAll|has)\(/,
-    message: "Next.js 15+: `cookies()` / `headers()` are async — `(await cookies()).get(...)`.",
-  },
   {
     id: "console-log-in-server", standard: "Backend/logging", severity: "low", files: [".ts", ".js"],
     test: /^\s*console\.log\(/,
@@ -94,12 +83,17 @@ const PATTERNS = [
   },
 ];
 
+// `pydantic-v1-api` and `next-sync-request-api` used to live here and fired
+// on every project — flagging `.dict()` in a repo pinned to Pydantic v1, where
+// it is the correct call. They are version checks now, in pins.json, and run
+// only when that major is detected (see versions.js pinPatterns).
+
 /**
  * Run the patterns over a unified diff. Only added lines are checked, and the
  * file's extension must be in the pattern's list. Returns review-shaped
  * findings: { file, line, severity, standard, rule, issue, fix, pattern }.
  */
-function runPatterns(diff, installedStandardIds) {
+function runPatterns(diff, installedStandardIds, patterns = PATTERNS) {
   const findings = [];
   let file = null, ext = "", line = 0;
   for (const raw of diff.split("\n")) {
@@ -119,13 +113,16 @@ function runPatterns(diff, installedStandardIds) {
     if (!raw.startsWith("+")) continue;
     const code = raw.slice(1);
     if (/^\s*(\/\/|#|\*|<!--)/.test(code)) continue; // comments
-    for (const p of PATTERNS) {
+    for (const p of patterns) {
       if (!p.files.includes(ext)) continue;
       if (!p.test.test(code)) continue;
       if (p.not && p.not.test(code)) continue;
       // Only report against standards the project actually installed, unless
       // the caller passes null to mean "everything".
-      if (installedStandardIds && !installedStandardIds.has(p.standard)) continue;
+      // Pin checks are scoped by the detected version instead: whether the
+      // project installed a Next.js standard says nothing about whether it
+      // runs Next 16.
+      if (!p.pin && installedStandardIds && !installedStandardIds.has(p.standard)) continue;
       findings.push({ file, line, severity: p.severity, standard: p.standard, rule: p.id, issue: p.message, fix: null, pattern: true });
     }
   }

package/src/lib/pro.js

@@ -21,7 +21,7 @@ const { verify, fingerprint, daysLeft } = require("./license");
 const { resolveKey } = require("./credentials");
 const { cmd } = require("./invocation");
 
-const UPGRADE_URL = process.env.AGENTMD_PRO_URL || "https://agent-dot-md.vercel.app/pro";
+const UPGRADE_URL = process.env.AGENTMD_PRO_URL || "https://agentmd.pages.dev/pro";
 
 /**
  * Every gated capability, with the sentence shown when it is reached without

package/src/lib/telemetry.js

@@ -28,7 +28,7 @@ const crypto = require("crypto");
 const { configDir } = require("./credentials");
 
 const FILE = "telemetry.json";
-const ENDPOINT = process.env.AGENTMD_TELEMETRY_URL || "https://agent-dot-md.vercel.app/api/telemetry";
+const ENDPOINT = process.env.AGENTMD_TELEMETRY_URL || "https://agentmd.pages.dev/api/telemetry";
 const settingsPath = () => path.join(configDir(), FILE);
 
 /** Exactly what may be sent. A field not in here cannot reach the wire. */

package/src/lib/versions.js

@@ -20,112 +20,31 @@
 const fs = require("fs");
 const path = require("path");
 
-/** lib -> major -> rules. Keys are npm names, PyPI names, or "go" / "python". */
-const PINS = {
-  next: {
-    label: "Next.js",
-    13: ["App Router (`app/`) exists but `pages/` is still common; check which this project uses before adding routes."],
-    14: ["App Router with Server Actions (stable). Navigate with `next/navigation`, not `next/router`, inside `app/`."],
-    15: [
-      "Request APIs are async: `await params`, `await searchParams`, `await cookies()`, `await headers()` — synchronous access is deprecated.",
-      "`fetch` is no longer cached by default; opt in with `cache: 'force-cache'` or `revalidate`.",
-      "Ships React 19: `ref` is a prop, `use()` and `useActionState` are available.",
-    ],
-    16: [
-      "Turbopack is the default bundler; do not add webpack-only config without checking it is still needed.",
-      "Request APIs are async only — `params`, `searchParams`, `cookies()`, `headers()` must be awaited; synchronous access was removed.",
-      "`middleware.ts` is `proxy.ts`; the old filename is not picked up.",
-      "Ships React 19: `ref` is a prop, `use()` and `useActionState` are available.",
-    ],
-  },
-  react: {
-    label: "React",
-    18: ["Mount with `createRoot` (not `ReactDOM.render`). Effects double-invoke in StrictMode during development — write them idempotently."],
-    19: [
-      "`ref` is a regular prop on function components — do not use `forwardRef`.",
-      "Use `use()` to read promises/context, `useActionState` and `useFormStatus` for forms; Actions can be passed to `<form action>`.",
-      "`propTypes` and `defaultProps` on function components are ignored; use TypeScript and default parameters.",
-    ],
-  },
-  pydantic: {
-    label: "Pydantic",
-    1: ["Pydantic v1 API: `.dict()`, `.json()`, `@validator`, `class Config`. Do not use v2 names (`model_dump`, `field_validator`)."],
-    2: [
-      "Use `.model_dump()` / `.model_dump_json()` / `.model_validate()` — `.dict()`, `.json()`, `.parse_obj()` are deprecated v1 names.",
-      "Validators are `@field_validator` and `@model_validator`; `@validator` and `@root_validator` are deprecated.",
-      "Configure with `model_config = ConfigDict(...)`, not an inner `class Config`. Use `TypeAdapter` for non-model types.",
-    ],
-  },
-  sqlalchemy: {
-    label: "SQLAlchemy",
-    2: [
-      "Use 2.0 style: `select()` with `session.execute()` / `session.scalars()`; `session.query()` is legacy.",
-      "Declare models with `DeclarativeBase`, `Mapped[...]` and `mapped_column()`; `declarative_base()` and `Column` are legacy.",
-    ],
-  },
-  django: {
-    label: "Django",
-    5: ["Django 5: `db_default` and `GeneratedField` exist; `USE_L10N` was removed; async ORM methods (`aget`, `acreate`, `afirst`) are available."],
-  },
-  prisma: {
-    label: "Prisma",
-    5: ["Prisma 5: `prisma.$extends` for extensions; `@prisma/client` generated in `node_modules` — run `prisma generate` after schema changes."],
-    6: ["Prisma 6: same API as 5; `omit` in queries is stable. Run `prisma generate` after schema changes."],
-    7: [
-      "Prisma 7 has no Rust query engine by default: instantiate the client with a driver adapter (for example `@prisma/adapter-pg`), not a bare `new PrismaClient()`.",
-      "Connection config lives in `prisma.config.ts`, not in the schema's `datasource url`.",
-    ],
-  },
-  tailwindcss: {
-    label: "Tailwind CSS",
-    3: ["Tailwind v3: `tailwind.config.js` with `content` globs, `@tailwind base/components/utilities` in CSS."],
-    4: [
-      "Tailwind v4 is CSS-first: `@import \"tailwindcss\"`, design tokens in `@theme`, `@custom-variant` — there is no `tailwind.config.js` unless the project added `@config`.",
-      "`@apply` in a separate CSS file needs `@reference`. Renamed utilities: `shadow-sm`→`shadow-xs`, `outline-none`→`outline-hidden`, `ring`→`ring-3`, `rounded-sm`→`rounded-xs`.",
-    ],
-  },
-  express: {
-    label: "Express",
-    5: [
-      "Express 5: rejected promises from async handlers reach error middleware automatically — no `next(err)` wrappers needed.",
-      "`req.query` is a read-only getter; route syntax is path-to-regexp v8 (`/{*splat}` instead of `*`, optional segments with `{}`); `res.redirect('back')` is gone.",
-    ],
-  },
-  zod: {
-    label: "Zod",
-    4: [
-      "Zod 4: use top-level formats `z.email()`, `z.uuid()`, `z.url()` — `z.string().email()` is deprecated.",
-      "Error details are `.issues` (not `.errors`); the `message` option is `error`; use `z.strictObject` / `z.looseObject` instead of `.strict()` / `.passthrough()`.",
-    ],
-  },
-  eslint: {
-    label: "ESLint",
-    9: ["ESLint 9 uses flat config (`eslint.config.js`); `.eslintrc*` is ignored unless `ESLINT_USE_FLAT_CONFIG=false`."],
-  },
-  vue: {
-    label: "Vue",
-    3: ["Vue 3: Composition API with `<script setup>`, `defineProps` / `defineEmits`; Options API still works. Vue 2 is end-of-life — do not add Vue 2 patterns like `Vue.extend`."],
-  },
-  go: {
-    label: "Go",
-    // keyed by "1.NN" from the go directive
-    "1.22": ["Go 1.22+: loop variables are per-iteration; `for i := range 10` works; `net/http` ServeMux supports methods and wildcards (`mux.HandleFunc(\"GET /items/{id}\", …)`)."],
-    "1.23": ["Go 1.23+: range-over-func iterators (`iter.Seq`); everything from 1.22 (per-iteration loop vars, method patterns in ServeMux)."],
-    "1.24": ["Go 1.24+: generic type aliases; `testing.B.Loop` for benchmarks; `go tool` directives in go.mod; everything from 1.22/1.23."],
-    "1.25": ["Go 1.25+: `testing/synctest` for concurrent tests; container-aware GOMAXPROCS; everything from 1.22–1.24."],
-  },
-  python: {
-    label: "Python",
-    "3.12": ["Python 3.12+: `type` statement and `class C[T]` generics (PEP 695), `typing.override`, f-strings may nest quotes; `distutils` is gone."],
-    "3.13": ["Python 3.13+: `warnings.deprecated`; everything from 3.12 (PEP 695 generics, `typing.override`)."],
-  },
-};
+/**
+ * The table lives in pins.json, not here, because two writers need it:
+ * people adding a pin, and scripts/measure-pins.js writing back the measured
+ * effect. `pins` keeps the lib -> label + major -> rules shape that link,
+ * the website and the score already read; `checks` and `proof` sit beside it
+ * rather than inside, so no consumer mistakes them for a major.
+ */
+const DATA = require("../pins.json");
+const PINS = DATA.pins;
+const CHECKS = DATA.checks || {};
+const PROOF = DATA.proof || {};
 
 const major = (range) => {
   const m = /(\d+)/.exec(String(range || ""));
   return m ? m[1] : null;
 };
 
+function installedVersion(cwd, name) {
+  try {
+    return JSON.parse(fs.readFileSync(path.join(cwd, "node_modules", name, "package.json"), "utf-8")).version || null;
+  } catch {
+    return null;
+  }
+}
+
 /** Read the majors this project runs, from whichever manifests exist. */
 function detectVersions(cwd) {
   const found = [];
@@ -142,8 +61,14 @@ function detectVersions(cwd) {
     try { pkg = JSON.parse(fs.readFileSync(pkgPath, "utf-8")); } catch {}
     const deps = pkg ? { ...pkg.dependencies, ...pkg.devDependencies } : {};
     for (const lib of ["next", "react", "prisma", "tailwindcss", "express", "zod", "eslint", "vue"]) {
-      const range = deps[lib] ?? (lib === "prisma" ? deps["@prisma/client"] : undefined);
-      if (range) push(lib, major(range), `package.json (${lib} ${range})`);
+      const name = deps[lib] !== undefined ? lib : lib === "prisma" && deps["@prisma/client"] !== undefined ? "@prisma/client" : null;
+      if (!name) continue;
+      // What is installed beats what is declared: `^15` says nothing about
+      // whether a lockfile bump already put 16 on disk. Works for npm, pnpm,
+      // yarn and bun alike, without parsing four lockfile formats.
+      const installed = installedVersion(cwd, name);
+      if (installed) push(lib, major(installed), `node_modules (${name} ${installed})`);
+      else push(lib, major(deps[name]), `package.json (${name} ${deps[name]})`);
     }
   }
 
@@ -187,4 +112,32 @@ function renderPins(pins) {
   return lines.join("\n");
 }
 
-module.exports = { PINS, detectVersions, renderPins };
+/**
+ * The detectors for the *old* API of each detected pin, in the shape
+ * runPatterns consumes. Scoped by version, not by installed standard: a
+ * Next 13 project must not be told `cookies()` is async, and a Next 16
+ * project must be told whether or not it installed a Next.js standard.
+ */
+function pinPatterns(pins) {
+  const out = [];
+  for (const p of pins) {
+    for (const c of (CHECKS[p.lib] && CHECKS[p.lib][p.version]) || []) {
+      out.push({
+        id: c.id,
+        standard: `${p.label} ${p.version}`,
+        severity: c.severity || "medium",
+        files: c.files,
+        test: new RegExp(c.test, "m"),
+        not: c.not ? new RegExp(c.not, "m") : null,
+        message: c.message,
+        pin: true,
+      });
+    }
+  }
+  return out;
+}
+
+/** Measured effect of a pin, if scripts/measure-pins.js has run for it. */
+const proofOf = (lib, version) => (PROOF[lib] && PROOF[lib][version]) || null;
+
+module.exports = { PINS, CHECKS, PROOF, detectVersions, renderPins, pinPatterns, proofOf };

package/src/pins.json

@@ -0,0 +1,403 @@
+{
+  "$comment": "Version pins: breaking changes per dependency major that a model trained on the previous major gets wrong. `pins` is what link writes (keep its shape: lib -> label + major -> rules). `checks` are deterministic detectors for the OLD api, used by `review --fast`, `lint` and as the judge in scripts/measure-pins.js. `proof` is written only by scripts/measure-pins.js — never by hand.",
+  "pins": {
+    "next": {
+      "13": [
+        "App Router (`app/`) exists but `pages/` is still common; check which this project uses before adding routes."
+      ],
+      "14": [
+        "App Router with Server Actions (stable). Navigate with `next/navigation`, not `next/router`, inside `app/`."
+      ],
+      "15": [
+        "Request APIs are async: `await params`, `await searchParams`, `await cookies()`, `await headers()` — synchronous access is deprecated.",
+        "`fetch` is no longer cached by default; opt in with `cache: 'force-cache'` or `revalidate`.",
+        "Ships React 19: `ref` is a prop, `use()` and `useActionState` are available."
+      ],
+      "16": [
+        "Turbopack is the default bundler; do not add webpack-only config without checking it is still needed.",
+        "Request APIs are async only — `params`, `searchParams`, `cookies()`, `headers()` must be awaited; synchronous access was removed.",
+        "`middleware.ts` is `proxy.ts`; the old filename is not picked up.",
+        "Ships React 19: `ref` is a prop, `use()` and `useActionState` are available."
+      ],
+      "label": "Next.js"
+    },
+    "react": {
+      "18": [
+        "Mount with `createRoot` (not `ReactDOM.render`). Effects double-invoke in StrictMode during development — write them idempotently."
+      ],
+      "19": [
+        "`ref` is a regular prop on function components — do not use `forwardRef`.",
+        "Use `use()` to read promises/context, `useActionState` and `useFormStatus` for forms; Actions can be passed to `<form action>`.",
+        "`propTypes` and `defaultProps` on function components are ignored; use TypeScript and default parameters."
+      ],
+      "label": "React"
+    },
+    "pydantic": {
+      "1": [
+        "Pydantic v1 API: `.dict()`, `.json()`, `@validator`, `class Config`. Do not use v2 names (`model_dump`, `field_validator`)."
+      ],
+      "2": [
+        "Use `.model_dump()` / `.model_dump_json()` / `.model_validate()` — `.dict()`, `.json()`, `.parse_obj()` are deprecated v1 names.",
+        "Validators are `@field_validator` and `@model_validator`; `@validator` and `@root_validator` are deprecated.",
+        "Configure with `model_config = ConfigDict(...)`, not an inner `class Config`. Use `TypeAdapter` for non-model types."
+      ],
+      "label": "Pydantic"
+    },
+    "sqlalchemy": {
+      "2": [
+        "Use 2.0 style: `select()` with `session.execute()` / `session.scalars()`; `session.query()` is legacy.",
+        "Declare models with `DeclarativeBase`, `Mapped[...]` and `mapped_column()`; `declarative_base()` and `Column` are legacy."
+      ],
+      "label": "SQLAlchemy"
+    },
+    "django": {
+      "5": [
+        "Django 5: `db_default` and `GeneratedField` exist; `USE_L10N` was removed; async ORM methods (`aget`, `acreate`, `afirst`) are available."
+      ],
+      "label": "Django"
+    },
+    "prisma": {
+      "5": [
+        "Prisma 5: `prisma.$extends` for extensions; `@prisma/client` generated in `node_modules` — run `prisma generate` after schema changes."
+      ],
+      "6": [
+        "Prisma 6: same API as 5; `omit` in queries is stable. Run `prisma generate` after schema changes."
+      ],
+      "7": [
+        "Prisma 7 has no Rust query engine by default: instantiate the client with a driver adapter (for example `@prisma/adapter-pg`), not a bare `new PrismaClient()`.",
+        "Connection config lives in `prisma.config.ts`, not in the schema's `datasource url`."
+      ],
+      "label": "Prisma"
+    },
+    "tailwindcss": {
+      "3": [
+        "Tailwind v3: `tailwind.config.js` with `content` globs, `@tailwind base/components/utilities` in CSS."
+      ],
+      "4": [
+        "Tailwind v4 is CSS-first: `@import \"tailwindcss\"`, design tokens in `@theme`, `@custom-variant` — there is no `tailwind.config.js` unless the project added `@config`.",
+        "`@apply` in a separate CSS file needs `@reference`. Renamed utilities: `shadow-sm`→`shadow-xs`, `outline-none`→`outline-hidden`, `ring`→`ring-3`, `rounded-sm`→`rounded-xs`."
+      ],
+      "label": "Tailwind CSS"
+    },
+    "express": {
+      "5": [
+        "Express 5: rejected promises from async handlers reach error middleware automatically — no `next(err)` wrappers needed.",
+        "`req.query` is a read-only getter; route syntax is path-to-regexp v8 (`/{*splat}` instead of `*`, optional segments with `{}`); `res.redirect('back')` is gone."
+      ],
+      "label": "Express"
+    },
+    "zod": {
+      "4": [
+        "Zod 4: use top-level formats `z.email()`, `z.uuid()`, `z.url()` — `z.string().email()` is deprecated.",
+        "Error details are `.issues` (not `.errors`); the `message` option is `error`; use `z.strictObject` / `z.looseObject` instead of `.strict()` / `.passthrough()`."
+      ],
+      "label": "Zod"
+    },
+    "eslint": {
+      "9": [
+        "ESLint 9 uses flat config (`eslint.config.js`); `.eslintrc*` is ignored unless `ESLINT_USE_FLAT_CONFIG=false`."
+      ],
+      "label": "ESLint"
+    },
+    "vue": {
+      "3": [
+        "Vue 3: Composition API with `<script setup>`, `defineProps` / `defineEmits`; Options API still works. Vue 2 is end-of-life — do not add Vue 2 patterns like `Vue.extend`."
+      ],
+      "label": "Vue"
+    },
+    "go": {
+      "label": "Go",
+      "1.22": [
+        "Go 1.22+: loop variables are per-iteration; `for i := range 10` works; `net/http` ServeMux supports methods and wildcards (`mux.HandleFunc(\"GET /items/{id}\", …)`)."
+      ],
+      "1.23": [
+        "Go 1.23+: range-over-func iterators (`iter.Seq`); everything from 1.22 (per-iteration loop vars, method patterns in ServeMux)."
+      ],
+      "1.24": [
+        "Go 1.24+: generic type aliases; `testing.B.Loop` for benchmarks; `go tool` directives in go.mod; everything from 1.22/1.23."
+      ],
+      "1.25": [
+        "Go 1.25+: `testing/synctest` for concurrent tests; container-aware GOMAXPROCS; everything from 1.22–1.24."
+      ]
+    },
+    "python": {
+      "label": "Python",
+      "3.12": [
+        "Python 3.12+: `type` statement and `class C[T]` generics (PEP 695), `typing.override`, f-strings may nest quotes; `distutils` is gone."
+      ],
+      "3.13": [
+        "Python 3.13+: `warnings.deprecated`; everything from 3.12 (PEP 695 generics, `typing.override`)."
+      ]
+    }
+  },
+  "checks": {
+    "next": {
+      "15": [
+        {
+          "id": "next-sync-request-api",
+          "files": [
+            ".ts",
+            ".tsx",
+            ".js",
+            ".jsx",
+            ".mjs"
+          ],
+          "test": "\\b(cookies|headers)\\(\\)\\.(get|set|getAll|has|delete)\\(",
+          "message": "Next.js 15+: `cookies()` / `headers()` are async — `(await cookies()).get(...)`."
+        },
+        {
+          "id": "next-sync-params",
+          "files": [
+            ".ts",
+            ".tsx"
+          ],
+          "test": "\\{\\s*(params|searchParams)\\s*[,}][^)]*\\)?\\s*:\\s*\\{\\s*(params|searchParams)\\s*:\\s*\\{",
+          "message": "Next.js 15+: `params` / `searchParams` are Promises — type them `Promise<{...}>` and `await` them."
+        }
+      ],
+      "16": [
+        {
+          "id": "next-sync-request-api",
+          "files": [
+            ".ts",
+            ".tsx",
+            ".js",
+            ".jsx",
+            ".mjs"
+          ],
+          "test": "\\b(cookies|headers)\\(\\)\\.(get|set|getAll|has|delete)\\(",
+          "message": "Next.js 16: `cookies()` / `headers()` must be awaited — synchronous access was removed."
+        },
+        {
+          "id": "next-sync-params",
+          "files": [
+            ".ts",
+            ".tsx"
+          ],
+          "test": "\\{\\s*(params|searchParams)\\s*[,}][^)]*\\)?\\s*:\\s*\\{\\s*(params|searchParams)\\s*:\\s*\\{",
+          "message": "Next.js 16: `params` / `searchParams` are Promises — type them `Promise<{...}>` and `await` them."
+        }
+      ]
+    },
+    "react": {
+      "18": [
+        {
+          "id": "react-legacy-render",
+          "files": [
+            ".ts",
+            ".tsx",
+            ".js",
+            ".jsx",
+            ".mjs"
+          ],
+          "test": "\\bReactDOM\\.render\\(",
+          "message": "React 18+: mount with `createRoot(el).render(...)`, not `ReactDOM.render`."
+        }
+      ],
+      "19": [
+        {
+          "id": "react-forward-ref",
+          "files": [
+            ".ts",
+            ".tsx",
+            ".js",
+            ".jsx",
+            ".mjs"
+          ],
+          "test": "\\bforwardRef\\s*[<(]",
+          "message": "React 19: `ref` is a regular prop — drop `forwardRef`."
+        },
+        {
+          "id": "react-function-proptypes",
+          "files": [
+            ".ts",
+            ".tsx",
+            ".js",
+            ".jsx",
+            ".mjs"
+          ],
+          "test": "^\\s*[A-Z]\\w*\\.(propTypes|defaultProps)\\s*=",
+          "message": "React 19: `propTypes` / `defaultProps` on function components are ignored — use TypeScript and default parameters."
+        }
+      ]
+    },
+    "pydantic": {
+      "1": [
+        {
+          "id": "pydantic-v2-api-on-v1",
+          "files": [
+            ".py"
+          ],
+          "test": "\\.model_dump\\(|\\.model_validate\\(|@field_validator\\b|ConfigDict\\(",
+          "message": "This project pins Pydantic v1 — `model_dump`, `field_validator`, `ConfigDict` do not exist there."
+        }
+      ],
+      "2": [
+        {
+          "id": "pydantic-v1-api",
+          "files": [
+            ".py"
+          ],
+          "test": "\\.(dict|json|parse_obj|parse_raw)\\(\\s*\\)|@(validator|root_validator)\\b|^\\s*class Config\\s*:",
+          "not": "model_dump|model_validate",
+          "message": "Pydantic v2: use `model_dump`, `model_validate`, `field_validator`, `model_config = ConfigDict(...)`."
+        }
+      ]
+    },
+    "sqlalchemy": {
+      "2": [
+        {
+          "id": "sqlalchemy-legacy-query",
+          "files": [
+            ".py"
+          ],
+          "test": "\\b(session|db\\.session|db)\\.query\\(\\s*[A-Z]",
+          "message": "SQLAlchemy 2.0: `session.execute(select(Model))` / `session.scalars(...)`, not `session.query(Model)`."
+        },
+        {
+          "id": "sqlalchemy-declarative-base",
+          "files": [
+            ".py"
+          ],
+          "test": "\\bdeclarative_base\\(\\)",
+          "message": "SQLAlchemy 2.0: subclass `DeclarativeBase` and use `Mapped[...]` / `mapped_column()`."
+        }
+      ]
+    },
+    "django": {
+      "5": [
+        {
+          "id": "django-use-l10n",
+          "files": [
+            ".py"
+          ],
+          "test": "^\\s*USE_L10N\\s*=",
+          "message": "Django 5: `USE_L10N` was removed."
+        }
+      ]
+    },
+    "prisma": {
+      "7": [
+        {
+          "id": "prisma-bare-client",
+          "files": [
+            ".ts",
+            ".tsx",
+            ".js",
+            ".jsx",
+            ".mjs"
+          ],
+          "test": "new\\s+PrismaClient\\(\\s*\\)",
+          "message": "Prisma 7: no Rust engine by default — pass a driver adapter, `new PrismaClient({ adapter })`."
+        }
+      ]
+    },
+    "tailwindcss": {
+      "4": [
+        {
+          "id": "tailwind-v3-directives",
+          "files": [
+            ".css",
+            ".scss",
+            ".pcss"
+          ],
+          "test": "^\\s*@tailwind\\s+(base|components|utilities)\\b",
+          "message": "Tailwind v4: `@import \"tailwindcss\";` replaces the three `@tailwind` directives."
+        }
+      ]
+    },
+    "express": {
+      "5": [
+        {
+          "id": "express-bare-wildcard",
+          "files": [
+            ".ts",
+            ".tsx",
+            ".js",
+            ".jsx",
+            ".mjs"
+          ],
+          "test": "\\.(get|post|put|patch|delete|all|use)\\(\\s*[\\x27\"][^\\x27\"]*\\/\\*[\\x27\"]",
+          "message": "Express 5: path-to-regexp v8 — name the wildcard, `/{*splat}`, not `*`."
+        },
+        {
+          "id": "express-redirect-back",
+          "files": [
+            ".ts",
+            ".tsx",
+            ".js",
+            ".jsx",
+            ".mjs"
+          ],
+          "test": "res\\.redirect\\(\\s*[\\x27\"]back[\\x27\"]",
+          "message": "Express 5: `res.redirect(\"back\")` was removed — use `req.get(\"Referrer\") || \"/\"`."
+        }
+      ]
+    },
+    "zod": {
+      "4": [
+        {
+          "id": "zod-string-format",
+          "files": [
+            ".ts",
+            ".tsx",
+            ".js",
+            ".jsx",
+            ".mjs"
+          ],
+          "test": "z\\.string\\(\\)\\.(email|uuid|url|cuid|ulid|ipv4|ipv6|datetime)\\(",
+          "message": "Zod 4: use the top-level formats `z.email()`, `z.uuid()`, `z.url()`."
+        },
+        {
+          "id": "zod-error-errors",
+          "files": [
+            ".ts",
+            ".tsx",
+            ".js",
+            ".jsx",
+            ".mjs"
+          ],
+          "test": "\\.error\\.errors\\b",
+          "message": "Zod 4: error details are `.issues`, not `.errors`."
+        }
+      ]
+    },
+    "vue": {
+      "3": [
+        {
+          "id": "vue2-global-api",
+          "files": [
+            ".js",
+            ".ts",
+            ".vue"
+          ],
+          "test": "\\bVue\\.extend\\(|\\bnew\\s+Vue\\(",
+          "message": "Vue 3: `createApp()` and `defineComponent()` — `new Vue` / `Vue.extend` are Vue 2."
+        }
+      ]
+    },
+    "python": {
+      "3.12": [
+        {
+          "id": "python-distutils",
+          "files": [
+            ".py"
+          ],
+          "test": "^\\s*(from|import)\\s+distutils\\b",
+          "message": "Python 3.12: `distutils` is gone — use `setuptools` or `sysconfig`."
+        }
+      ],
+      "3.13": [
+        {
+          "id": "python-distutils",
+          "files": [
+            ".py"
+          ],
+          "test": "^\\s*(from|import)\\s+distutils\\b",
+          "message": "Python 3.13: `distutils` is gone — use `setuptools` or `sysconfig`."
+        }
+      ]
+    }
+  },
+  "proof": {}
+}