upstream-radar 0.33.3 → 0.33.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (8) hide show
  1. package/README.md +19 -16
  2. package/dist/src/render.d.ts.map +1 -1
  3. package/dist/src/render.js +2 -0
  4. package/dist/src/render.js.map +1 -1
  5. package/dist/src/version.d.ts +1 -1
  6. package/dist/src/version.js +1 -1
  7. package/docs/README.zh-CN.md +19 -19
  8. package/package.json +1 -1
package/README.md CHANGED
@@ -90,7 +90,7 @@ The useful part is the exact path and project-specific next step—not another g
90
90
  Want to try it on a real published DSH plugin immediately?
91
91
 
92
92
  ```bash
93
- npx --yes upstream-radar@0.33.3 inspect dsh-feishu-bot@0.15.4 --deep
93
+ npx --yes upstream-radar@0.33.4 inspect dsh-feishu-bot@0.15.4 --deep
94
94
  ```
95
95
 
96
96
  This runs from an otherwise empty directory and returns a short admission,
@@ -100,7 +100,7 @@ Want to see a real author-actionable result? This exact published DSH plugin
100
100
  currently cannot produce a complete dependency graph in a clean npm resolver:
101
101
 
102
102
  ```bash
103
- npx --yes upstream-radar@0.33.3 inspect \
103
+ npx --yes upstream-radar@0.33.4 inspect \
104
104
  @sanqi-normal/dsh-webui-market-plugin@0.5.4 \
105
105
  --deep --fail-on never
106
106
  ```
@@ -232,6 +232,9 @@ dependencies mixed into source lockfiles, three plugin lockfiles whose root
232
232
  version lagged the source manifest, and a tarball format the scanner could not
233
233
  parse. The [batch report](examples/dsh/reports/dsh-batch-50-2026-08-17.md)
234
234
  keeps those results honest; it is not marketed as a vulnerability hit list.
235
+ The three repeated lockfile-metadata cases are rechecked in the
236
+ [follow-up report](examples/dsh/reports/lockfile-metadata-follow-up-2026-08-18.md),
237
+ with an author-ready issue draft for the first maintainer.
235
238
 
236
239
  ## Observe DSH plugin upstream changes
237
240
 
@@ -270,7 +273,7 @@ Then run one cycle:
270
273
 
271
274
  ```bash
272
275
  export GITHUB_TOKEN='a read-only GitHub token'
273
- npx --yes upstream-radar@0.33.3 observe \
276
+ npx --yes upstream-radar@0.33.4 observe \
274
277
  ./targets.yml \
275
278
  --state ./observations.json \
276
279
  --report ./upstream-radar-observer.md
@@ -518,7 +521,7 @@ cd my-dsh-plugin
518
521
  pnpm install --ignore-scripts
519
522
 
520
523
  # Read the exact graph before adding the plugin to a DSH profile.
521
- pnpm dlx --package=upstream-radar@0.33.3 upstream-radar graph pnpm-lock pnpm-lock.yaml --json
524
+ pnpm dlx --package=upstream-radar@0.33.4 upstream-radar graph pnpm-lock pnpm-lock.yaml --json
522
525
  ```
523
526
 
524
527
  The graph includes the exact DSH package versions and keeps unresolved optional peers visible. It does not load the generated plugin or run lifecycle scripts. After reviewing it, copy this complete workflow into `.github/workflows/upstream-radar.yml`:
@@ -540,7 +543,7 @@ jobs:
540
543
  runs-on: ubuntu-latest
541
544
  steps:
542
545
  - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
543
- - uses: MicroMilo/upstream-radar@v0.33.3
546
+ - uses: MicroMilo/upstream-radar@v0.33.4
544
547
  with:
545
548
  fail-on: high
546
549
  fail-on-compatibility: breaking
@@ -551,7 +554,7 @@ The Action auto-detects the one `pnpm-lock.yaml`, checks the same exact graph, a
551
554
  To check a real published DSH artifact directly, run one command:
552
555
 
553
556
  ```bash
554
- npx --yes upstream-radar@0.33.3 inspect dsh-feishu-bot@0.15.4 --deep
557
+ npx --yes upstream-radar@0.33.4 inspect dsh-feishu-bot@0.15.4 --deep
555
558
  ```
556
559
 
557
560
  The checked result is `REVIEW`: registry integrity, signature, provenance, and
@@ -708,7 +711,7 @@ To see the two-source vulnerability contract without contacting the network, run
708
711
  Before wiring a project into a compatibility gate, run the offline rule benchmark:
709
712
 
710
713
  ```bash
711
- pnpm dlx --package=upstream-radar@0.33.3 upstream-radar benchmark compatibility
714
+ pnpm dlx --package=upstream-radar@0.33.4 upstream-radar benchmark compatibility
712
715
  ```
713
716
 
714
717
  It covers six contracts: a safe patch, a change that only needs project analysis, an incompatible DSH peer, a publisher-declared breaking release, a vulnerable candidate dependency, and an incomplete candidate graph. The command does not access the network, install a package, load a plugin, or start DSH. It checks the behavior of Radar's deterministic rules and the `breaking`/`any` gates; it is not a runtime compatibility proof.
@@ -721,7 +724,7 @@ When you have an exact plugin artifact and want to know whether one exact DSH re
721
724
  # Pack an exact npm release without running its lifecycle scripts.
722
725
  npm pack --ignore-scripts dsh-plugin@1.2.3
723
726
 
724
- pnpm dlx --package=upstream-radar@0.33.3 upstream-radar probe dsh-load \
727
+ pnpm dlx --package=upstream-radar@0.33.4 upstream-radar probe dsh-load \
725
728
  ./dsh-plugin-1.2.3.tgz \
726
729
  --dsh-version 0.1.0-rc.6
727
730
  ```
@@ -747,7 +750,7 @@ It exercises a loadable bundle, a bundle patch DSH rejects, and a package that r
747
750
  To compare a plugin against more than one DSH release, use the matrix form:
748
751
 
749
752
  ```bash
750
- pnpm dlx --package=upstream-radar@0.33.3 upstream-radar probe dsh-matrix \
753
+ pnpm dlx --package=upstream-radar@0.33.4 upstream-radar probe dsh-matrix \
751
754
  ./dsh-plugin-1.2.3.tgz \
752
755
  --dsh-version 0.1.0-rc.3 \
753
756
  --dsh-version 0.1.0-rc.6 \
@@ -763,7 +766,7 @@ If your team wants the shortest scheduled CI gate before wiring a machine to a l
763
766
  ```yaml
764
767
  steps:
765
768
  - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
766
- - uses: MicroMilo/upstream-radar@v0.33.3
769
+ - uses: MicroMilo/upstream-radar@v0.33.4
767
770
  with:
768
771
  fail-on: high
769
772
  # Optional: also fail on deterministic DSH/plugin compatibility breaks.
@@ -772,12 +775,12 @@ steps:
772
775
  threat-intel: true
773
776
  ```
774
777
 
775
- The Action is a thin wrapper around `radar check --frozen --state :memory: --fail-on high --json`; when the optional compatibility input is enabled, it also passes `--fail-on-compatibility breaking` or `any`. `--frozen` is deliberate: it uses the graph in the reviewed config and does not try to read a developer's local DSH profile. `threat-intel` is false by default so an ordinary CI gate stays lean; set it to `true` when the Job Summary and raw JSON should include CISA KEV and FIRST EPSS prioritization evidence. Each run is independent, exits `2` when an active vulnerability or opted-in compatibility change meets its threshold, and exits `1` for an operational or source error. `breaking` catches confirmed or strong incompatibility signals; `any` catches every active compatibility event. The default is `never`, so vulnerability-only behavior stays unchanged. In addition to the raw JSON log, the Action writes a short escaped summary to the GitHub Job Summary so a scheduled failure immediately shows the affected package, exact path, published fix version when available, one-line priority evidence, and a suggested next step. The Action does not deliver a DSH Agent task or modify a branch; the native DSH bundle remains the always-on analysis path. Pin the Action to a release tag such as `v0.33.3`, and pin the checkout Action in your workflow according to your repository's policy.
778
+ The Action is a thin wrapper around `radar check --frozen --state :memory: --fail-on high --json`; when the optional compatibility input is enabled, it also passes `--fail-on-compatibility breaking` or `any`. `--frozen` is deliberate: it uses the graph in the reviewed config and does not try to read a developer's local DSH profile. `threat-intel` is false by default so an ordinary CI gate stays lean; set it to `true` when the Job Summary and raw JSON should include CISA KEV and FIRST EPSS prioritization evidence. Each run is independent, exits `2` when an active vulnerability or opted-in compatibility change meets its threshold, and exits `1` for an operational or source error. `breaking` catches confirmed or strong incompatibility signals; `any` catches every active compatibility event. The default is `never`, so vulnerability-only behavior stays unchanged. In addition to the raw JSON log, the Action writes a short escaped summary to the GitHub Job Summary so a scheduled failure immediately shows the affected package, exact path, published fix version when available, one-line priority evidence, and a suggested next step. The Action does not deliver a DSH Agent task or modify a branch; the native DSH bundle remains the always-on analysis path. Pin the Action to a release tag such as `v0.33.4`, and pin the checkout Action in your workflow according to your repository's policy.
776
779
 
777
780
  If the repository has no committed Radar config yet, the smallest setup is to omit `config`, `pnpm-lock`, and `npm-lock`. After checkout, the Action automatically uses the only one of `pnpm-lock.yaml` or `package-lock.json` that exists, generates a temporary reviewed config, and runs the same frozen check:
778
781
 
779
782
  ```yaml
780
- - uses: MicroMilo/upstream-radar@v0.33.3
783
+ - uses: MicroMilo/upstream-radar@v0.33.4
781
784
  with:
782
785
  fail-on: high
783
786
  ```
@@ -787,7 +790,7 @@ An existing `config` wins over auto-detection. If both lockfiles exist, or neith
787
790
  To review the exact plugin artifact before it enters DSH, add `inspect-package`:
788
791
 
789
792
  ```yaml
790
- - uses: MicroMilo/upstream-radar@v0.33.3
793
+ - uses: MicroMilo/upstream-radar@v0.33.4
791
794
  with:
792
795
  inspect-package: dsh-cloudflare-browser-run@0.1.1
793
796
  # review is the safe default; use block only when incomplete coverage may pass.
@@ -799,7 +802,7 @@ This downloads that exact npm tarball, verifies the registry integrity/signature
799
802
  If the repository has a pnpm lockfile but no committed Radar config yet, the Action can generate the config in the same job. See the [copyable pnpm workflow](examples/github-actions/upstream-radar-pnpm.yml):
800
803
 
801
804
  ```yaml
802
- - uses: MicroMilo/upstream-radar@v0.33.3
805
+ - uses: MicroMilo/upstream-radar@v0.33.4
803
806
  with:
804
807
  pnpm-lock: pnpm-lock.yaml
805
808
  fail-on: high
@@ -813,7 +816,7 @@ See the [copyable npm workflow](examples/github-actions/upstream-radar-npm.yml)
813
816
  The Action requires the caller to check out the repository first. It does not install the project's dependencies or run their lifecycle scripts; it only reads the committed graph and queries the configured upstream sources. For a fully explicit, lower-level invocation, the equivalent command is:
814
817
 
815
818
  ```bash
816
- pnpm dlx --package=upstream-radar@0.33.3 upstream-radar radar check \
819
+ pnpm dlx --package=upstream-radar@0.33.4 upstream-radar radar check \
817
820
  ./upstream-radar.config.json --frozen --state :memory: --fail-on high \
818
821
  --fail-on-compatibility breaking --json
819
822
  ```
@@ -821,7 +824,7 @@ pnpm dlx --package=upstream-radar@0.33.3 upstream-radar radar check \
821
824
  To add the optional DSH load matrix for a published plugin, provide an exact npm package and at least two exact DSH versions:
822
825
 
823
826
  ```yaml
824
- - uses: MicroMilo/upstream-radar@v0.33.3
827
+ - uses: MicroMilo/upstream-radar@v0.33.4
825
828
  id: radar
826
829
  with:
827
830
  config: upstream-radar.config.json
package/dist/src/render.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"render.d.ts","sourceRoot":"","sources":["../../src/render.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAsB5C,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CA6E3D"}
1
+ {"version":3,"file":"render.d.ts","sourceRoot":"","sources":["../../src/render.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAsB5C,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CA8E3D"}
package/dist/src/render.js CHANGED
@@ -65,6 +65,8 @@ export function renderTextReport(report) {
65
65
  for (const finding of report.findings) {
66
66
  lines.push(` [${finding.severity.toUpperCase()}] ${display(finding.code)}: ${display(finding.summary)}`);
67
67
  lines.push(` ${display(finding.detail, 2_048)}`);
68
+ if (finding.remediation !== undefined)
69
+ lines.push(` Fix: ${display(finding.remediation, 2_048)}`);
68
70
  }
69
71
  }
70
72
  const nextStep = report.riskVerdict === 'block'
package/dist/src/render.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"render.js","sourceRoot":"","sources":["../../src/render.ts"],"names":[],"mappings":"AAMA,SAAS,OAAO,CAAC,KAAa,EAAE,SAAS,GAAG,GAAG;IAC7C,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,+BAA+B,EAAE,SAAS,CAAC,EAAE,CAAC,CAC1E,MAAM,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,MAAM,EAAE,CAC1E,CAAC,CAAA;IACF,OAAO,OAAO,CAAC,MAAM,IAAI,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,GAAG,CAAA;AAClF,CAAC;AAED,SAAS,qBAAqB,CAC5B,KAA0F,EAC1F,IAAoB;IAEpB,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,IAAI,CAAC,CAAA;IAC9D,MAAM,UAAU,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,EAAE,CAAA;IACxF,OAAO,KAAK,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAA;AAC/H,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,MAAkB;IACjD,MAAM,KAAK,GAAG;QACZ,kBAAkB,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE;QACvC,WAAW,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE;QACrH,aAAa,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE;QAC3C,eAAe,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE;QACzG,sBAAsB,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE;QACpD,iBAAiB,MAAM,CAAC,WAAW,CAAC,WAAW,EAAE,EAAE;QACnD,qBAAqB,MAAM,CAAC,eAAe,CAAC,WAAW,EAAE,EAAE;QAC3D,EAAE;QACF,WAAW;QACX,oBAAoB,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE;QAClD,yBAAyB,MAAM,CAAC,QAAQ,CAAC,iBAAiB,EAAE;QAC5D,yBAAyB,MAAM,CAAC,QAAQ,CAAC,iBAAiB,EAAE;QAC5D,4BAA4B,MAAM,CAAC,QAAQ,CAAC,oBAAoB,EAAE;QAClE,iBAAiB,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE;QAC7C,4BAA4B,MAAM,CAAC,QAAQ,CAAC,mBAAmB,EAAE;QACjE,yBAAyB,MAAM,CAAC,QAAQ,CAAC,iBAAiB,EAAE;QAC5D,EAAE;QACF,aAAa,MAAM,CAAC,QAAQ,CAAC,YAAY,IAAI,MAAM,CAAC,QAAQ,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC,QAAQ,CAAC,WAAW,WAAW,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,MAAM,0BAA0B;KAC3M,CAAA;IAED,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAA;QAC/B,KAAK,CAAC,IAAI,CACR,EAAE,EACF,uBAAuB,EACvB,eAAe,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EACtC,wBAAwB,GAAG,CAAC,SAAS,CAAC,MAAM,KAAK,GAAG,CAAC,SAAS,CAAC,SAAS,GAAG,EAC3E,yBAAyB,GAAG,CAAC,iBAAiB,CAAC,MAAM,EAAE,EACvD,iBAAiB,GAAG,CAAC,UAAU,CAAC,MAAM,EAAE,EACxC,uBAAuB,GAAG,CAAC,eAAe,CAAC,MAAM,EAAE,EACnD,wBAAwB,GAAG,CAAC,eAAe,CAAC,QAAQ,IAAI,cAAc,EAAE,CACzE,CAAA;QACD,IAAI,GAAG,CAAC,UAAU,CAAC,gBAAgB,KAAK,SAAS;YAAE,KAAK,CAAC,IAAI,CAAC,wBAAwB,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAA;QACjI,IAAI,GAAG,CAAC,UAAU,CAAC,YAAY,KAAK,SAAS;YAAE,KAAK,CAAC,IAAI,CAAC,oBAAoB,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC,CAAA;QACrH,IAAI,GAAG,CAAC,UAAU,CAAC,QAAQ,KAAK,SAAS;YAAE,KAAK,CAAC,IAAI,CAAC,qBAAqB,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;QAC9G,IAAI,GAAG,CAAC,eAAe,CAAC,WAAW,KAAK,SAAS;YAAE,KAAK,CAAC,IAAI,CAAC,mBAAmB,GAAG,CAAC,eAAe,CAAC,WAAW,EAAE,CAAC,CAAA;QACnH,MAAM,UAAU,GAAG,GAAG,CAAC,eAAe,CAAC,KAAK,EAAE,UAAU,CAAA;QACxD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,MAAM,CAAA;YAC3E,KAAK,CAAC,IAAI,CAAC,kCAAkC,UAAU,CAAC,MAAM,GAAG,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,QAAQ,YAAY,EAAE,CAAC,CAAA;YACnH,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1B,KAAK,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAA;gBACxC,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,eAAe,CAAC,KAAM,EAAE,IAAI,CAAC,CAAC,CAAA;gBAC/G,IAAI,UAAU,CAAC,MAAM,GAAG,EAAE;oBAAE,KAAK,CAAC,IAAI,CAAC,SAAS,UAAU,CAAC,MAAM,GAAG,EAAE,0BAA0B,CAAC,CAAA;gBACjG,KAAK,CAAC,IAAI,CAAC,kHAAkH,CAAC,CAAA;YAChI,CAAC;QACH,CAAC;QACD,IAAI,GAAG,CAAC,eAAe,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;YACjD,MAAM,eAAe,GAAG,GAAG,CAAC,eAAe,CAAC,eAAe,CAAA;YAC3D,KAAK,CAAC,IAAI,CAAC,4BAA4B,eAAe,CAAC,KAAK,WAAW,eAAe,CAAC,QAAQ,cAAc,eAAe,CAAC,IAAI,QAAQ,CAAC,CAAA;QAC5I,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,+CAA+C,CAAC,CAAA;IACjE,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,aAAa,MAAM,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAA;QACvD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtC,KAAK,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;YACzG,KAAK,CAAC,IAAI,CAAC,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAA;QACrD,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,KAAK,OAAO;QAC7C,CAAC,CAAC,qEAAqE;QACvE,CAAC,CAAC,MAAM,CAAC,WAAW,KAAK,QAAQ;YAC/B,CAAC,CAAC,2GAA2G;YAC7G,CAAC,CAAC,MAAM,CAAC,WAAW,KAAK,MAAM;gBAC7B,CAAC,CAAC,oFAAoF;gBACtF,CAAC,CAAC,MAAM,CAAC,eAAe,KAAK,YAAY;oBACvC,CAAC,CAAC,kFAAkF;oBACpF,CAAC,CAAC,uFAAuF,CAAA;IACjG,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,cAAc,QAAQ,EAAE,CAAC,CAAA;IACxC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,6EAA6E,CAAC,CAAA;IAC7F,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAA;AAChC,CAAC"}
1
+ {"version":3,"file":"render.js","sourceRoot":"","sources":["../../src/render.ts"],"names":[],"mappings":"AAMA,SAAS,OAAO,CAAC,KAAa,EAAE,SAAS,GAAG,GAAG;IAC7C,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,+BAA+B,EAAE,SAAS,CAAC,EAAE,CAAC,CAC1E,MAAM,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,MAAM,EAAE,CAC1E,CAAC,CAAA;IACF,OAAO,OAAO,CAAC,MAAM,IAAI,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,GAAG,CAAA;AAClF,CAAC;AAED,SAAS,qBAAqB,CAC5B,KAA0F,EAC1F,IAAoB;IAEpB,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,IAAI,CAAC,CAAA;IAC9D,MAAM,UAAU,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,EAAE,CAAA;IACxF,OAAO,KAAK,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAA;AAC/H,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,MAAkB;IACjD,MAAM,KAAK,GAAG;QACZ,kBAAkB,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE;QACvC,WAAW,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE;QACrH,aAAa,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE;QAC3C,eAAe,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE;QACzG,sBAAsB,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE;QACpD,iBAAiB,MAAM,CAAC,WAAW,CAAC,WAAW,EAAE,EAAE;QACnD,qBAAqB,MAAM,CAAC,eAAe,CAAC,WAAW,EAAE,EAAE;QAC3D,EAAE;QACF,WAAW;QACX,oBAAoB,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE;QAClD,yBAAyB,MAAM,CAAC,QAAQ,CAAC,iBAAiB,EAAE;QAC5D,yBAAyB,MAAM,CAAC,QAAQ,CAAC,iBAAiB,EAAE;QAC5D,4BAA4B,MAAM,CAAC,QAAQ,CAAC,oBAAoB,EAAE;QAClE,iBAAiB,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE;QAC7C,4BAA4B,MAAM,CAAC,QAAQ,CAAC,mBAAmB,EAAE;QACjE,yBAAyB,MAAM,CAAC,QAAQ,CAAC,iBAAiB,EAAE;QAC5D,EAAE;QACF,aAAa,MAAM,CAAC,QAAQ,CAAC,YAAY,IAAI,MAAM,CAAC,QAAQ,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC,QAAQ,CAAC,WAAW,WAAW,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,MAAM,0BAA0B;KAC3M,CAAA;IAED,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAA;QAC/B,KAAK,CAAC,IAAI,CACR,EAAE,EACF,uBAAuB,EACvB,eAAe,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EACtC,wBAAwB,GAAG,CAAC,SAAS,CAAC,MAAM,KAAK,GAAG,CAAC,SAAS,CAAC,SAAS,GAAG,EAC3E,yBAAyB,GAAG,CAAC,iBAAiB,CAAC,MAAM,EAAE,EACvD,iBAAiB,GAAG,CAAC,UAAU,CAAC,MAAM,EAAE,EACxC,uBAAuB,GAAG,CAAC,eAAe,CAAC,MAAM,EAAE,EACnD,wBAAwB,GAAG,CAAC,eAAe,CAAC,QAAQ,IAAI,cAAc,EAAE,CACzE,CAAA;QACD,IAAI,GAAG,CAAC,UAAU,CAAC,gBAAgB,KAAK,SAAS;YAAE,KAAK,CAAC,IAAI,CAAC,wBAAwB,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAA;QACjI,IAAI,GAAG,CAAC,UAAU,CAAC,YAAY,KAAK,SAAS;YAAE,KAAK,CAAC,IAAI,CAAC,oBAAoB,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC,CAAA;QACrH,IAAI,GAAG,CAAC,UAAU,CAAC,QAAQ,KAAK,SAAS;YAAE,KAAK,CAAC,IAAI,CAAC,qBAAqB,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;QAC9G,IAAI,GAAG,CAAC,eAAe,CAAC,WAAW,KAAK,SAAS;YAAE,KAAK,CAAC,IAAI,CAAC,mBAAmB,GAAG,CAAC,eAAe,CAAC,WAAW,EAAE,CAAC,CAAA;QACnH,MAAM,UAAU,GAAG,GAAG,CAAC,eAAe,CAAC,KAAK,EAAE,UAAU,CAAA;QACxD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,MAAM,CAAA;YAC3E,KAAK,CAAC,IAAI,CAAC,kCAAkC,UAAU,CAAC,MAAM,GAAG,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,QAAQ,YAAY,EAAE,CAAC,CAAA;YACnH,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1B,KAAK,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAA;gBACxC,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,eAAe,CAAC,KAAM,EAAE,IAAI,CAAC,CAAC,CAAA;gBAC/G,IAAI,UAAU,CAAC,MAAM,GAAG,EAAE;oBAAE,KAAK,CAAC,IAAI,CAAC,SAAS,UAAU,CAAC,MAAM,GAAG,EAAE,0BAA0B,CAAC,CAAA;gBACjG,KAAK,CAAC,IAAI,CAAC,kHAAkH,CAAC,CAAA;YAChI,CAAC;QACH,CAAC;QACD,IAAI,GAAG,CAAC,eAAe,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;YACjD,MAAM,eAAe,GAAG,GAAG,CAAC,eAAe,CAAC,eAAe,CAAA;YAC3D,KAAK,CAAC,IAAI,CAAC,4BAA4B,eAAe,CAAC,KAAK,WAAW,eAAe,CAAC,QAAQ,cAAc,eAAe,CAAC,IAAI,QAAQ,CAAC,CAAA;QAC5I,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,+CAA+C,CAAC,CAAA;IACjE,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,aAAa,MAAM,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAA;QACvD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtC,KAAK,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;YACzG,KAAK,CAAC,IAAI,CAAC,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAA;YACnD,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS;gBAAE,KAAK,CAAC,IAAI,CAAC,YAAY,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC,CAAA;QACtG,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,KAAK,OAAO;QAC7C,CAAC,CAAC,qEAAqE;QACvE,CAAC,CAAC,MAAM,CAAC,WAAW,KAAK,QAAQ;YAC/B,CAAC,CAAC,2GAA2G;YAC7G,CAAC,CAAC,MAAM,CAAC,WAAW,KAAK,MAAM;gBAC7B,CAAC,CAAC,oFAAoF;gBACtF,CAAC,CAAC,MAAM,CAAC,eAAe,KAAK,YAAY;oBACvC,CAAC,CAAC,kFAAkF;oBACpF,CAAC,CAAC,uFAAuF,CAAA;IACjG,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,cAAc,QAAQ,EAAE,CAAC,CAAA;IACxC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,6EAA6E,CAAC,CAAA;IAC7F,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAA;AAChC,CAAC"}
package/dist/src/version.d.ts CHANGED
@@ -1,2 +1,2 @@
1
- export declare const TOOL_VERSION = "0.33.3";
1
+ export declare const TOOL_VERSION = "0.33.4";
2
2
  //# sourceMappingURL=version.d.ts.map
package/dist/src/version.js CHANGED
@@ -1,2 +1,2 @@
1
- export const TOOL_VERSION = '0.33.3';
1
+ export const TOOL_VERSION = '0.33.4';
2
2
  //# sourceMappingURL=version.js.map
package/docs/README.zh-CN.md CHANGED
@@ -84,7 +84,7 @@ FIRST EPSS estimated exploitation probability: 97.2% (percentile 100.0%)
84
84
  想立即检查一个真实发布的 DSH 插件，可以在空目录直接运行：
85
85
 
86
86
  ```bash
87
- npx --yes upstream-radar@0.33.3 inspect dsh-feishu-bot@0.15.4 --deep
87
+ npx --yes upstream-radar@0.33.4 inspect dsh-feishu-bot@0.15.4 --deep
88
88
  ```
89
89
 
90
90
  它会直接输出简短的准入结论、覆盖情况、依赖数量、漏洞数量和下一步，不需要先
@@ -94,7 +94,7 @@ npx --yes upstream-radar@0.33.3 inspect dsh-feishu-bot@0.15.4 --deep
94
94
  npm 解析环境中目前无法建立完整依赖图：
95
95
 
96
96
  ```bash
97
- npx --yes upstream-radar@0.33.3 inspect \
97
+ npx --yes upstream-radar@0.33.4 inspect \
98
98
  @sanqi-normal/dsh-webui-market-plugin@0.5.4 \
99
99
  --deep --fail-on never
100
100
  ```
@@ -212,7 +212,7 @@ OpenAI-compatible 模型，先设置
212
212
  漏洞数是 **0**。但这批样本发现了真实的监控质量问题：源码锁文件混入开发依赖、
213
213
  3 个插件的锁文件根版本落后于源码 manifest，以及一个扫描器暂时无法解析的 tar
214
214
  格式。[完整报告](../examples/dsh/reports/dsh-batch-50-2026-08-17.md)保留了这些
215
- 结果；我们不会把它包装成“发现了 50 个漏洞”。
215
+ 结果；我们不会把它包装成“发现了 50 个漏洞”。其中 3 个重复出现的锁文件根版本问题已经重新复核，见[后续报告](../examples/dsh/reports/lockfile-metadata-follow-up-2026-08-18.md)，里面也保留了第一位维护者可以直接确认的 issue 草稿。
216
216
 
217
217
  ## 观察 DSH 插件的上游变化
218
218
 
@@ -231,7 +231,7 @@ old → new 变化比较
231
231
  只有重要变化 → DSH Agent 任务 → 报告
232
232
  ```
233
233
 
234
- 可以从[可复制的 targets 示例](../examples/upstream-observer/targets.yml)开始：
234
+ 可以从[可复制的真实 targets 示例](../examples/upstream-observer/targets.yml)开始。它默认观察公开的 DSH/飞书插件 `PlutoKeating/dsh-lark-bot`，不是模拟项目：
235
235
 
236
236
  ```yaml
237
237
  schema: upstream-radar.observer-targets/v1alpha1
@@ -293,8 +293,8 @@ Radar 只读取这次调用需要的接口地址、API key 和模型名，不会
293
293
 
294
294
  可复制的定时 workflow 是
295
295
  [examples/github-actions/upstream-observer.yml](../examples/github-actions/upstream-observer.yml)。
296
- 仓库里这份 workflow 是 Radar 自己的 dogfood 示例：它先 checkout 并构建 Radar，
297
- 再执行观察器。它只提交观察点；没有变化时不会每天制造一条 commit。
296
+ 仓库里这份 workflow 会先 checkout 并构建 Radar，再观察这个公开的 DSH/飞书插件，
297
+ 所以既是 dogfood 也是一个真实插件示例。它只提交观察点；没有变化时不会每天制造一条 commit。
298
298
 
299
299
  这个 workflow 支持三个可选的 repository secret：
300
300
  `ISSUE_LOCATOR_LLM_BASE_URL`、`ISSUE_LOCATOR_LLM_API_KEY` 和
@@ -497,7 +497,7 @@ cd my-dsh-plugin
497
497
  pnpm install --ignore-scripts
498
498
 
499
499
  # 把插件放进 DSH profile 前，先读取精确依赖图。
500
- pnpm dlx --package=upstream-radar@0.33.3 upstream-radar graph pnpm-lock pnpm-lock.yaml --json
500
+ pnpm dlx --package=upstream-radar@0.33.4 upstream-radar graph pnpm-lock pnpm-lock.yaml --json
501
501
  ```
502
502
 
503
503
  这棵图会保留精确的 DSH 包版本，也会把未解析的可选 peer 明确显示出来；它不会加载生成的插件，也不会运行 lifecycle script。审查后，把下面这个完整 workflow 复制到 `.github/workflows/upstream-radar.yml`：
@@ -519,7 +519,7 @@ jobs:
519
519
  runs-on: ubuntu-latest
520
520
  steps:
521
521
  - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
522
- - uses: MicroMilo/upstream-radar@v0.33.3
522
+ - uses: MicroMilo/upstream-radar@v0.33.4
523
523
  with:
524
524
  fail-on: high
525
525
  fail-on-compatibility: breaking
@@ -530,7 +530,7 @@ Action 会自动识别唯一的 `pnpm-lock.yaml`，检查同一棵精确依赖
530
530
  也可以直接检查一个真实发布的 DSH 包：
531
531
 
532
532
  ```bash
533
- npx --yes upstream-radar@0.33.3 inspect dsh-feishu-bot@0.15.4 --deep
533
+ npx --yes upstream-radar@0.33.4 inspect dsh-feishu-bot@0.15.4 --deep
534
534
  ```
535
535
 
536
536
  这次检查的结论是 `REVIEW`：registry 完整性、签名、provenance 和 89 个已解析包都
@@ -696,7 +696,7 @@ pnpm run try:dsh
696
696
  在把项目接入兼容性门禁前，可以先运行离线规则 benchmark：
697
697
 
698
698
  ```bash
699
- pnpm dlx --package=upstream-radar@0.33.3 upstream-radar benchmark compatibility
699
+ pnpm dlx --package=upstream-radar@0.33.4 upstream-radar benchmark compatibility
700
700
  ```
701
701
 
702
702
  它覆盖六类契约：安全补丁、只需要项目分析的变化、不兼容的 DSH peer、发布者明确声明 breaking、候选传递依赖漏洞，以及候选依赖图不完整。这个命令不会联网、安装包、加载插件或启动 DSH；它验证的是 Radar 的确定性规则以及 `breaking`/`any` 门禁行为，不是运行时兼容性证明。
@@ -709,7 +709,7 @@ pnpm dlx --package=upstream-radar@0.33.3 upstream-radar benchmark compatibility
709
709
  # 打包精确版本，并明确不运行它的 lifecycle script。
710
710
  npm pack --ignore-scripts dsh-plugin@1.2.3
711
711
 
712
- pnpm dlx --package=upstream-radar@0.33.3 upstream-radar probe dsh-load \
712
+ pnpm dlx --package=upstream-radar@0.33.4 upstream-radar probe dsh-load \
713
713
  ./dsh-plugin-1.2.3.tgz \
714
714
  --dsh-version 0.1.0-rc.6
715
715
  ```
@@ -735,7 +735,7 @@ pnpm run showcase:dsh-probe
735
735
  如果要比较多个 DSH 版本，可以使用矩阵入口：
736
736
 
737
737
  ```bash
738
- pnpm dlx --package=upstream-radar@0.33.3 upstream-radar probe dsh-matrix \
738
+ pnpm dlx --package=upstream-radar@0.33.4 upstream-radar probe dsh-matrix \
739
739
  ./dsh-plugin-1.2.3.tgz \
740
740
  --dsh-version 0.1.0-rc.3 \
741
741
  --dsh-version 0.1.0-rc.6 \
@@ -753,7 +753,7 @@ JSON 结果结构见[矩阵结果 schema](../schemas/dsh-load-matrix.schema.json
753
753
  ```yaml
754
754
  steps:
755
755
  - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
756
- - uses: MicroMilo/upstream-radar@v0.33.3
756
+ - uses: MicroMilo/upstream-radar@v0.33.4
757
757
  with:
758
758
  fail-on: high
759
759
  # 可选：把确定性的 DSH/插件兼容性破坏也作为 CI 失败条件
@@ -762,12 +762,12 @@ steps:
762
762
  threat-intel: true
763
763
  ```
764
764
 
765
- 这个 Action 只是 `radar check --frozen --state :memory: --fail-on high --fail-on-compatibility breaking --json` 的薄封装。`--frozen` 是有意的：它只使用配置文件里的依赖图，不会尝试读取 runner 上不存在的本地 DSH profile。`threat-intel` 默认是 `false`，这样普通 CI 门禁不会因为额外查询变重；设置为 `true` 后，Job Summary 和原始 JSON 会包含 CISA KEV 与 FIRST EPSS 的优先级证据。每次运行彼此独立；发现达到阈值的漏洞或选择的兼容性变化时返回 `2`，运行或漏洞源出错时返回 `1`。`breaking` 只拦截有 confirmed/strong 信号的兼容性事件，`any` 会拦截所有活动兼容性事件，默认值是 `never`。除了原始 JSON 日志，Action 还会把经过转义的简短摘要写入 GitHub Job Summary，定时任务失败时可以直接看到受影响的包、准确依赖路径、已经发布的修复版本（如果有）、一行优先级证据和建议的下一步。这个入口不会投递 DSH Agent 任务，也不会修改分支；需要持续监控和项目级分析时，仍使用原生 DSH bundle。建议把 Action 固定到类似 `v0.33.3` 的发布标签，并根据团队策略固定 checkout Action。
765
+ 这个 Action 只是 `radar check --frozen --state :memory: --fail-on high --fail-on-compatibility breaking --json` 的薄封装。`--frozen` 是有意的：它只使用配置文件里的依赖图，不会尝试读取 runner 上不存在的本地 DSH profile。`threat-intel` 默认是 `false`，这样普通 CI 门禁不会因为额外查询变重；设置为 `true` 后，Job Summary 和原始 JSON 会包含 CISA KEV 与 FIRST EPSS 的优先级证据。每次运行彼此独立；发现达到阈值的漏洞或选择的兼容性变化时返回 `2`，运行或漏洞源出错时返回 `1`。`breaking` 只拦截有 confirmed/strong 信号的兼容性事件，`any` 会拦截所有活动兼容性事件，默认值是 `never`。除了原始 JSON 日志，Action 还会把经过转义的简短摘要写入 GitHub Job Summary，定时任务失败时可以直接看到受影响的包、准确依赖路径、已经发布的修复版本（如果有）、一行优先级证据和建议的下一步。这个入口不会投递 DSH Agent 任务，也不会修改分支；需要持续监控和项目级分析时，仍使用原生 DSH bundle。建议把 Action 固定到类似 `v0.33.4` 的发布标签，并根据团队策略固定 checkout Action。
766
766
 
767
767
  如果仓库还没有提交 Radar 配置，最短接入方式是省略 `config`、`pnpm-lock` 和 `npm-lock`。checkout 之后，Action 会自动使用唯一存在的 `pnpm-lock.yaml` 或 `package-lock.json`，生成临时的审查清单，再执行同一个 frozen 检查：
768
768
 
769
769
  ```yaml
770
- - uses: MicroMilo/upstream-radar@v0.33.3
770
+ - uses: MicroMilo/upstream-radar@v0.33.4
771
771
  with:
772
772
  fail-on: high
773
773
  ```
@@ -777,7 +777,7 @@ steps:
777
777
  如果要在插件进入 DSH 前审查精确发布物，可以增加 `inspect-package`：
778
778
 
779
779
  ```yaml
780
- - uses: MicroMilo/upstream-radar@v0.33.3
780
+ - uses: MicroMilo/upstream-radar@v0.33.4
781
781
  with:
782
782
  inspect-package: dsh-cloudflare-browser-run@0.1.1
783
783
  # review 是安全默认值；只有允许覆盖不完整时才使用 block
@@ -789,7 +789,7 @@ steps:
789
789
  如果仓库只有 pnpm 锁文件，还没有提交 Radar 配置，可以让 Action 在同一个 job 中生成配置；可直接复制[pnpm workflow 示例](../examples/github-actions/upstream-radar-pnpm.yml)：
790
790
 
791
791
  ```yaml
792
- - uses: MicroMilo/upstream-radar@v0.33.3
792
+ - uses: MicroMilo/upstream-radar@v0.33.4
793
793
  with:
794
794
  pnpm-lock: pnpm-lock.yaml
795
795
  fail-on: high
@@ -803,7 +803,7 @@ npm 项目可以改用 `npm-lock: package-lock.json`；`pnpm-lock` 和 `npm-lock
803
803
  调用方需要先 checkout 仓库。这个 Action 不会安装项目依赖，也不会执行项目的 lifecycle script；它只读取提交到仓库的依赖图并查询配置中的上游漏洞源。如果需要完全显式的底层命令，等价写法是：
804
804
 
805
805
  ```bash
806
- pnpm dlx --package=upstream-radar@0.33.3 upstream-radar radar check \
806
+ pnpm dlx --package=upstream-radar@0.33.4 upstream-radar radar check \
807
807
  ./upstream-radar.config.json --frozen --state :memory: --fail-on high \
808
808
  --fail-on-compatibility breaking --json
809
809
  ```
@@ -811,7 +811,7 @@ pnpm dlx --package=upstream-radar@0.33.3 upstream-radar radar check \
811
811
  如果还要检查一个已发布插件能否跨多个 DSH 版本加载，可以增加三个 input：
812
812
 
813
813
  ```yaml
814
- - uses: MicroMilo/upstream-radar@v0.33.3
814
+ - uses: MicroMilo/upstream-radar@v0.33.4
815
815
  id: radar
816
816
  with:
817
817
  config: upstream-radar.config.json
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "upstream-radar",
3
- "version": "0.33.3",
3
+ "version": "0.33.4",
4
4
  "description": "Always-on dependency security monitoring for DeepSeek Harness (DSH) plugins: find exact installed or candidate transitive vulnerable paths and breaking updates, then route evidence to a DSH Agent.",
5
5
  "type": "module",
6
6
  "license": "Apache-2.0",