deprecated-tracker 2.3.1 → 2.6.0

package/CHANGELOG.md

@@ -2,6 +2,100 @@
 
 All notable changes to the "Deprecated Tracker" extension will be documented in this file.
 
+## Release channels
+
+One version number covers three artifacts — the VS Code extension, the same
+extension on Open VSX, and the `deprecated-tracker` CLI on npm — and their
+published version lists are **not identical**. Nothing has ever been
+unpublished; the gaps are releases that had nothing to ship for that artifact.
+
+- **npm** carries `2.2.0`, `2.3.0`, `2.3.1`, `2.5.0`. The CLI's first release to
+  the registry was `2.2.0`. `2.4.0` and `2.4.1` are absent because neither
+  changed the CLI — publishing a byte-identical CLI under a new number would say
+  something changed when nothing had.
+- **Open VSX** carries `1.0.0`, `1.2.0`, `1.5.0`, `2.3.0`, `2.3.1`, `2.5.0`, `2.5.1`.
+- **The VS Code Marketplace** carries the extension releases.
+
+If a version is missing from the channel you are looking at, the entry below
+tells you which artifact it changed. A release that touches only one artifact is
+noted as such in its own section.
+
+## [2.6.0]
+
+### Added
+
+- **The CLI reports the three-way split the results panel is built around.** Every deprecated declaration is one of three things and each is a different job: something still calls it and the tag says what to use instead (*documented*), something still calls it and the tag says nothing (*bare*), or nothing calls it any more (*unused* — deletable today). The text report now states the counts under its headline, and `--format json` carries them as `summary`. It counts declarations rather than items, so it deliberately does not sum to `total`.
+- **`items[].declaration` in the JSON report.** Usages now name the declaration they came from — its symbol, file and line. Previously the JSON had no link between a call site and the declaration it reached, so a consumer could only group by name, which silently merges two different symbols that happen to share one. The MCP tools return both new fields as well, so an agent reads the same shape.
+- **The help opens with a command you can paste.** `npx deprecated-tracker .` is the first line, ahead of the synopsis, and the description says what the tool reports rather than only how it exits.
+
+Both JSON additions are new fields. No existing field changed name, type or meaning, and `kind` still reports exactly what it did.
+
+## [2.5.1]
+
+*Extension only — the CLI is unchanged, so this version is not published to npm.*
+
+### Fixed
+
+- **The results panel flashed its collapsible regions on open.** Five elements in `main.html` were hidden with a `style="display: none;"` attribute, and the panel's CSP is `style-src {{cspSource}}` with no `'unsafe-inline'`, so the browser dropped every one of them. Each was hidden only because a script later assigned `.style.display`, which left an empty hero, an empty filter-chip row, the keyboard hint and the entire ignore view painting for a frame before the first render corrected them. Three of the five arrived with the 2.5.0 redesign. They are now hidden by class — the stylesheet holds `display: none` and a `.show` rule restores the exact display value each element had — which is the same pattern the AI prompt modal has used since 1.5.0, when this mechanism last caused a visible bug.
+
+- **The ignore manager rendered unstyled at its edges.** Its tab strip sat flush against the panel edge, because the inset for that markup was only ever applied to the standalone panels that hang the tabs off `.container` — `.ignore-view`, which hosts the same markup in the results panel, has no padding of its own despite a comment claiming otherwise. Separately, the four "nothing here yet" rows appeared as tall blank bands with their text stranded mid-panel: they are `<li>` elements carrying `.empty-state`, which is the results table's full-panel treatment of 64px padding and centred text. Both are now correct, and the stylesheet no longer carries rules for two element ids that stopped existing when the standalone ignore panel was removed.
+- **The settings and requirements panels reset when you switched tabs.** 2.5.0 fixed this for three panels, one of which was the standalone ignore panel that has since been removed, leaving two of the four remaining panels still tearing down their webview on hide and reloading it on reveal. Settings had `retainContextWhenHidden: false` set explicitly: the settings themselves are written on `change` so nothing saved was ever at risk, but the tag filter box, a partly filled add/edit tag modal and the scroll position were all lost. Requirements is read-only and lost only its scroll position. Both now retain context.
+
+### Internal
+
+- **The extension is published to both registries by one command.** `npm run publish-extension` builds the package and pushes the *same* `.vsix` to the VS Code Marketplace and to Open VSX. Previously only the npm CLI had a publish script and both extension registries were manual, separate steps — which is the whole reason Open VSX is missing `2.0.x`–`2.2.x` and all of `2.4.x`. It refuses to start unless both `VSCE_PAT` and `OVSX_PAT` are present, so a half-finished release cannot leave the two registries on different versions, and it publishes one artifact to both rather than building twice, so they cannot carry different bytes under one version number.
+- **The `.vsix` no longer carries a second, unreachable copy of every webview script and stylesheet.** `.vscodeignore` re-included all of `src/webview/assets`, so each script and stylesheet shipped twice. Only the `out/` copy is ever loaded — every `scriptUri` and `styleUri` is built from that directory and `localResourceRoots` is restricted to it, so the `src/` copy could not have been loaded even if a URI had pointed at it. The `.html` templates stay, because both `loadTemplate` implementations fall back to them. 141,804 bytes smaller.
+- **The standalone ignore panel is gone.** Ignore management moved inside the results panel some releases ago and the separate panel has had no production caller since, but `src/webview/index.ts` re-exported it, which was enough to keep it compiling, covered by tests and maintained — the 2.5.0 redesign added `retainContextWhenHidden` and a tab icon to a class nothing could open. Removing it, its two webview assets and the tests that existed only to cover them drops roughly 1,250 lines. Coverage stays at 100%.
+- **`copy-assets` prunes its output directory before copying.** It created the destination if missing and then copied over it, so a file deleted from `src/webview/assets` survived in `out/` until the directory was cleared by hand. Because `.vscodeignore` re-includes `out/src/webview/assets/**`, a locally built `.vsix` kept shipping assets the source no longer had. CI was never affected — it always starts from a clean checkout.
+
+## [2.5.0]
+
+### Changed
+
+- **Every surface was redesigned.** The results panel, the statistics overview, the settings panel and the sidebar view now share one palette, one type scale and one set of icons. The organising idea is the only classification the scanner can make honestly for every project: each deprecated declaration is **documented** (it names a replacement), **bare** (it says nothing) or **unused** (nothing calls it), and each is a different job. No severity levels and no removal-version grouping, both of which were explored and neither of which exists reliably in the data — `deprecationSchedule` is optional and usually absent, because it can only be recovered from prose in the tag. A composition band above the results carries the three counts, and each row picks up a coloured rail for its class.
+- **Emoji are gone from the interface.** `📊 📋 📦 ⚠️ 🔗 📈 🎯 🔥` in the statistics dashboard and `🔍 ⚙️ 📊 📋 🕒` in the sidebar are inline SVG, which takes a colour, follows the theme and renders identically on every platform. One pair remains, in the requirements panel, because an asset test asserts its exact text.
+- **The panel chrome shrank.** A 24px heading with 35px of padding around it became a 44px toolbar; rows are 38px. On a panel docked to a third of the screen, the old proportions spent more space describing the view than showing it. The sidebar lost its card border and its 44px drop-shadowed buttons for the same reason.
+- **Three hardcoded colours are gone.** `#ff9800`, `#f57c00` and `#ff6b6b` ignored the theme entirely. Every rule now reads a `--dt-*` token, and high-contrast themes hand every one of those tokens straight back to VS Code rather than overriding it.
+
+### Added
+
+- **The composition band filters.** Clicking *documented*, *no reason* or *unused* narrows the table to that class, and the active segment is marked with a ring rather than by colour alone.
+- **Resizable columns.** Drag the boundary between any two headers; double-click resets. The handle draws nothing — the `col-resize` cursor is the whole affordance — and it is grabbable beside any row, not only in the header.
+- **Click a row to expand its call sites**, with the count shown as a badge instead of a `Show 2 usages` button. Clicks that land on a link or a button still belong to that control.
+- **The table header stays put while the rows scroll.**
+- **Symbol and file names are reachable from the keyboard.** They were already clickable, but they are `<span>`s, so they had no tab stop and no `Enter` handler. Both now do, and the hover affordance is an underline that appears on the row rather than a permanent one — an underlined list is unreadable.
+
+### Fixed
+
+- **Switching away from a panel and back reset it.** `MainPanel` explicitly set `retainContextWhenHidden: false`, so VS Code tore the webview down whenever the tab went to the background and reloaded the HTML on return, losing the scroll position and every expanded call-site list. Clicking a result — the panel's main action — moved focus to the editor and did exactly that. The statistics and ignore panels never set the option at all and defaulted to the same behaviour. All three now retain their context, and the webview additionally declines to rebuild the table when it is re-sent a result set identical to the one already on screen.
+- **A column filter could zero a symbol's call sites.** The filters tested each item independently, but a declaration and its call sites are separate items and the call sites usually live in other files. Filtering by `api` therefore deleted every usage recorded in `edge-usages.ts` and left the declarations reading `0 · unused` — the row then classified itself as unused, which was false. Filters now select whole groups, matched against the same values the row displays, so a surviving group keeps all of its items.
+- **Cancelling a scan hid the View Results button until the next successful one.** Starting a scan hid the button, and neither the cancel path nor the failure path restored it, even though the previous scan's results were still held and still openable. The button's visibility now follows only whether results exist.
+- **The row separator broke into pieces.** It was drawn per cell, and the rows are CSS grids: the line stopped at every column gap, fell short of the row padding at both ends, and — because the cells are centred and differ in height — drew each segment at its own height. The separator belongs to the row.
+- **The webview panels showed a generic document icon** in their editor tabs. All five now carry the extension's own mark, in the light and dark variants VS Code needs for a tab icon.
+
+### Internal
+
+- **`style.css` was rebuilt on a token layer.** Every rule consumed `--vscode-*` directly across 1,467 lines, so a palette change meant editing hundreds of declarations; there is now one `:root` block and one override per theme class. Roughly 110 lines of verbatim-duplicated rules and 17 rule blocks with no matching markup were removed at the same time.
+- **`settings.css` carries its own copy of the tokens.** `SettingsPanel` builds its own `styleUri` and loads that file alone, so it never sees the shared stylesheet; pointing it at the shared tokens would leave every colour undefined.
+- **`--dt-faint` is not the colour the palette specified.** `#6F7B83` measures 3.9:1 on the dark ground and `#7E8A91` measures 3.5:1 on the light one, both under the 4.5:1 that AA requires for body text. They are `#8A959C` and `#6B767D`.
+
+## [2.4.1]
+
+### Fixed
+
+- **The webview panels escaped some values and not others.** The results history and the four statistics tables ran names, file paths and reasons through `escapeHtml`, but interpolated counts, kinds and scan ids straight into `innerHTML` on the assumption that a number cannot carry markup. That assumption holds for the value's type and not for its origin: every one of those fields is derived from the scanned project, which is code the extension was pointed at rather than code it trusts. Six sites across `main.js` and `statistics.js` now escape uniformly. Escaping a number is free, and a template where some interpolations are escaped and others are not is a template nobody can review at a glance.
+
+### Internal
+
+- **The packaging scripts built shell command strings out of `__dirname`.** `scripts/package.js` and `scripts/publish.js` composed `npm` and `npx` invocations by interpolating an absolute path into a string and handing it to `execSync`, so a checkout directory containing shell metacharacters would have been interpreted rather than quoted. Both now use `execFileSync` with an argv array, which has no shell to interpret anything. They invoke npm through `process.env.npm_execpath` rather than spawning `npm.cmd`, because Node refuses to spawn a `.cmd` without a shell and re-adding one would have undone the fix. The consequence for contributors: these scripts must be run through npm — `npm run build-package`, not `node scripts/package.js`, which now exits with a message saying so.
+- **Pinned patched versions of six transitive development dependencies.** An `overrides` block moves `js-yaml`, `minimatch`, `@babel/core` and `ajv` onto their fixed releases, taking `npm audit` to zero. None of this reaches a user: the published package declares no runtime dependencies, and these packages exist only under jest, eslint and their trees.
+
+## [2.4.0]
+
+### Added
+
+- **Go to declaration, from the usage.** A deprecated usage told you what it was and why, but not where the deprecated symbol lives — finding that meant searching for the name and picking the declaration out of its own call sites. The diagnostic now carries the declaration's location, so VS Code links to it from the Problems panel and the hover, and **Quick Fix** on the usage offers **Go to declaration (file:line)**. It navigates and nothing else: applying a replacement guessed out of the prose in a `@deprecated` tag stays parked, because a wrong edit is worse than none.
+
 ## [2.3.1]
 
 ### Fixed

package/SECURITY.md

@@ -0,0 +1,52 @@
+# Security Policy
+
+## Supported versions
+
+Fixes land on the latest released version only. There are no maintenance
+branches for older releases.
+
+| Version | Supported |
+| ------- | --------- |
+| 2.4.x   | Yes       |
+| < 2.4   | No        |
+
+## Reporting a vulnerability
+
+Report privately through GitHub, not in a public issue:
+
+1. Go to the [Security tab](https://github.com/milad-hub/deprecated-tracker/security)
+2. Choose **Report a vulnerability**
+
+That opens a private advisory visible only to you and the maintainer. Please
+include the version, the platform, and the smallest reproduction you can manage.
+
+Expect an acknowledgement within a week. If a report is confirmed, the fix and
+the advisory are published together.
+
+## Scope
+
+The published npm package declares no runtime dependencies, but that is a
+statement about `package.json`, not about what executes on your machine.
+esbuild inlines whatever the sources import, so the TypeScript compiler ships
+inside `out/cli.js`. Anything bundled into a released artifact is in scope no
+matter which dependency block it was declared in.
+
+Reports that are in scope include:
+
+- Code execution or file access outside the scanned project, whether from the
+  CLI, the MCP server, or a configuration file
+- Cross-site scripting in the extension's webview panels, which render names,
+  file paths, and reasons taken from the scanned code
+- The `mcp install` / `mcp uninstall` commands writing outside their declared
+  target when given hostile input
+- Vulnerabilities in third-party code bundled into the published `.tgz` or
+  `.vsix`, including the TypeScript compiler
+
+Out of scope:
+
+- Vulnerabilities in build and test tooling that never leaves the development
+  machine — jest, eslint, prettier, esbuild and their dependency trees. These
+  are tracked through Dependabot instead.
+- Denial of service caused by pointing the scanner at a deliberately
+  pathological project. The scanner is a developer tool run against code you
+  already have on disk.

package/docs/CLI.md

@@ -154,15 +154,19 @@ npx deprecated-tracker --files src/a.ts src/b.ts --format json
 {
   "passed": false,
   "total": 1,
+  "summary": { "documented": 1, "bare": 0, "unused": 0 },
   "items": [
     { "name": "oldApi", "kind": "usage", "file": "src/a.ts",
-      "line": 12, "character": 10, "reason": "Use newApi instead" }
+      "line": 12, "character": 10, "reason": "Use newApi instead",
+      "declaration": { "name": "oldApi", "file": "src/api.ts", "line": 4 } }
   ]
 }
 ```
 
 - **Unstaged edits are covered.** A file with no staged hunks is read as entirely changed, so everything in it is reported — nothing needs staging or committing first.
 - **`items[].reason`** carries the `@deprecated` text, usually the replacement instruction. That is the field to act on.
+- **`items[].declaration`** is where the deprecated symbol is declared, and is present on usages only. It is the identity to group call sites by: two different symbols can share a name, so matching on `name` alone merges them.
+- **`summary`** counts *declarations*, not items, so it does not sum to `total`. A declaration is `documented` when something still calls it and the tag says what to use instead, `bare` when something still calls it and the tag says nothing, and `unused` when nothing calls it any more — which is the one that is deletable today. The same three-way split the extension's results panel is organised around, and it is derivable from `items` alone if you would rather compute it yourself.
 - **Exit code is the verdict, not an error:** `1` means findings. An agent that treats any non-zero exit as a crash will misread it.
 - Drop `--files` and pass a path to scan the whole project; add `--fail-on-any` to ignore the baseline.