v11y-check 0.15.8 → 0.16.0

package/.meta/changelog.json

@@ -0,0 +1,663 @@
+[
+  {
+    "version": "0.16.0",
+    "date": "2026-09-08",
+    "sections": [
+      {
+        "title": "🎉 Features",
+        "audience": "all",
+        "items": [
+          {
+            "description": "Report a package whose tarball would omit its changelog (#768)",
+            "body": "Adds ReadyUp checks to verify that every published package bundles its changelog files: the human-readable `CHANGELOG.md` and the machine-readable `changelog.json`.",
+            "hash": "25dd5c01b5e5b0ac26b266613fe71f47428e6c5c"
+          }
+        ]
+      },
+      {
+        "title": "🧪 Tests",
+        "audience": "dev",
+        "items": [
+          {
+            "description": "Read console spy output with listConsoleLines rather than by hand (#781)",
+            "body": "- Replaces the hand-rolled reads of a console spy's `mock.calls` in the `nmr`, `release-kit`, and `v11y-check` test suites with `listConsoleLines` from `@williamthorsen/toolbelt.vitest/candidate`.\n- Clears the `toolbelt.vitest/no-console-calls-read` recommendation that `rdy run --packages` reported.",
+            "hash": "9a5fbc2f01e8468821be89c345c59ade913074f4"
+          }
+        ]
+      }
+    ]
+  },
+  {
+    "version": "0.15.8",
+    "date": "2026-09-01",
+    "sections": [
+      {
+        "title": "♻️ Refactoring",
+        "audience": "dev",
+        "items": [
+          {
+            "description": "Upgrade to readyup v0.34 and exclude a private repo root from kit checks (#759)",
+            "body": "Upgrades `readyup` to v0.34, whose `discoverWorkspaces` now reports the repo root. `release-kit`'s `npm-auto-publish` kit filters that root out unless it is publishable, so a private root is no longer listed in the kit's report.\n\nTest suites for release-kit's ReadyUp kits have been refactored to use the patterns documented in v0.34.",
+            "hash": "2c0cf04c9a282e10e03c3fd1a44d4330b8a25a94"
+          }
+        ]
+      },
+      {
+        "title": "⚙️ Tooling",
+        "audience": "dev",
+        "items": [
+          {
+            "description": "Restrict node:fs scaffolding in test code to the temporary tree's API (#756)",
+            "body": "Adds an ESLint restriction that flags the `node:fs` and `node:fs/promises` calls that scaffold a temporary directory in test code instead of using the `TempTree` API. Also migrates `v11y-check`'s `node:fs/promises` scaffolding to that API.",
+            "hash": "c3290759d44f6396602bd3bd69a00d6518e2e0cc"
+          }
+        ]
+      }
+    ]
+  },
+  {
+    "version": "0.15.7",
+    "date": "2026-08-24",
+    "sections": [
+      {
+        "title": "♻️ Refactoring",
+        "audience": "dev",
+        "items": [
+          {
+            "description": "Upgrade ReadyUp and the toolbelt packages, adopting their new APIs (#748)",
+            "body": "Upgrades `readyup` and the `@williamthorsen/toolbelt.*` packages to their latest versions.\n\nThe `readFile` utility from `readyup` replaces hand-rolled code in `nmr`.",
+            "hash": "9e54b0670c67b6b1da5d7afca7fe071ecbed2797"
+          }
+        ]
+      },
+      {
+        "title": "🧪 Tests",
+        "audience": "dev",
+        "items": [
+          {
+            "description": "Scaffold the nmr-core, root, and v11y-check trees through the write API (#734)",
+            "body": "Converts the `node:fs` scaffolding in five test suites across `nmr-core`, the repo root, and `v11y-check` to the temporary tree's own write API, which refuses a path that escapes the tree. Fixture helpers in `hashWorkingTree.tool.test.ts` and `init.unit.test.ts` take the tree itself in place of a captured directory string.",
+            "hash": "91afecf0302d84ac8e67607b81a0269b1c410464"
+          }
+        ]
+      }
+    ]
+  },
+  {
+    "version": "0.15.6",
+    "date": "2026-08-20",
+    "sections": [
+      {
+        "title": "🧪 Tests",
+        "audience": "dev",
+        "items": [
+          {
+            "description": "Register the working directory for disposal alongside the tree it points into (#724)",
+            "body": "Converts the `release-kit` and `v11y-check` suites that run from inside a temporary directory to `createTempTree` and `pointCwdAt`, registered through `disposeOnTestFinished` or scoped with `using`. Reverse-order disposal now restores the working directory before removing the tree it pointed into, which each suite previously had to sequence by hand.",
+            "hash": "6d3a42a33913ae9900b8a2d106329dcf690941e6"
+          },
+          {
+            "description": "Route the remaining hand-built temporary directories through createTempTree (#725)",
+            "body": "Replaces the hand-built temporary directories in the `release-kit` and `v11y-check` test suites with a `createTempTree` fixture, dropping the `beforeEach`/`afterEach` pairs that created and removed them.",
+            "hash": "92e76397f6f5ef3068b7f4805599fd090f930f7d"
+          }
+        ]
+      }
+    ]
+  },
+  {
+    "version": "0.15.5",
+    "date": "2026-08-19",
+    "sections": [
+      {
+        "title": "🧪 Tests",
+        "audience": "dev",
+        "items": [
+          {
+            "description": "Register fixture-repo cleanup against the test that asks for it (#715)",
+            "body": "Routes nmr's `buildRepo` fixture helper through `createTempTree`, registering each fixture directory's removal against the test that requested it. The module-level accumulator and the exported `removeFixtureDirs` have been removed.",
+            "hash": "4186900691928b41e56b6f1855ca74b9700c1968"
+          }
+        ]
+      }
+    ]
+  },
+  {
+    "version": "0.15.3",
+    "date": "2026-08-17",
+    "sections": [
+      {
+        "title": "♻️ Refactoring",
+        "audience": "dev",
+        "items": [
+          {
+            "description": "Adopt silenceConsole across the test suites (#677)",
+            "body": "Adopts `silenceConsole` from `@williamthorsen/toolbelt.vitest` to replace all hand-rolled `vi.spyOn(console, …)` spies and reduce boilerplate across the repo's test suites. The function returns a disposable, allowing the caller to use `using` to enable restoration of the console method at the end of the test scope.",
+            "hash": "412fd27cfe1324612aa123d1f8166fb6b37a07ff"
+          }
+        ]
+      },
+      {
+        "title": "🧪 Tests",
+        "audience": "dev",
+        "items": [
+          {
+            "description": "Replace the stdio spies with captureStdio (#678)",
+            "body": "Replaces every `process.stdout` and `process.stderr` spy in the test suites with `captureStdio` from `@williamthorsen/toolbelt.testing` and deletes the obviated local capture helpers. `captureStdio` buffers writes rather than recording calls, so assertions that previously used `toHaveBeenCalledWith` instead check `stderr`/`stdout` strings and their chunk arrays.\n\nSeparately, `unicorn/no-nonstandard-builtin-properties` is off for test files. Its hand-maintained symbol table omits `Symbol.dispose`, which a suite-scoped capture calls to restore the streams, and `schema: []` offers no way to extend the table.",
+            "hash": "b59304680cd26864d282ec3b36eac31bc2e0386d"
+          }
+        ]
+      },
+      {
+        "title": "👷 CI",
+        "audience": "dev",
+        "items": [
+          {
+            "description": "Migrate the reusable workflows to pnpm/setup (#687)",
+            "body": "Migrates the four reusable workflows from `pnpm/action-setup` to `pnpm/setup`, which installs pnpm as a native standalone binary and can supply the JavaScript runtime in the same step. `audit`, `create-github-release`, and `publish` now set up in one step with no `actions/setup-node`; `release` keeps it, because `pnpm/setup` omits `npm` and `npx` from the runtime it installs while `release-kit prepare` spawns `npx git-cliff` and `npx prettier`.\n\nMigration: consumers of `audit`, `create-github-release`, and `publish` need a `devEngines.packageManager` or `packageManager` field pinning pnpm 11 or newer, the only range `pnpm/setup` installs. `create-github-release` and `publish` additionally need `@williamthorsen/release-kit` as a root dependency, because they now invoke it through `pnpm exec` instead of `npx --yes`.",
+            "migration": "Consumers of `audit`, `create-github-release`, and `publish` need a `devEngines.packageManager` or `packageManager` field pinning pnpm 11 or newer, the only range `pnpm/setup` installs. `create-github-release` and `publish` additionally need `@williamthorsen/release-kit` as a root dependency, because they now invoke it through `pnpm exec` instead of `npx --yes`.",
+            "hash": "4934262977ae2a8955c5308e590b330cfc8042da"
+          }
+        ]
+      }
+    ]
+  },
+  {
+    "version": "0.15.2",
+    "date": "2026-08-13",
+    "sections": [
+      {
+        "title": "♻️ Refactoring",
+        "audience": "dev",
+        "items": [
+          {
+            "description": "Adopt toolbelt.errors for error-message extraction and cause-chaining (#652)",
+            "body": "Improves error reporting by adopting standardized ways of capturing and describing errors across the codebase.",
+            "hash": "30e6dac440ca7c61b8f44fb2998ff9e933425008"
+          }
+        ]
+      },
+      {
+        "title": "⚙️ Tooling",
+        "audience": "dev",
+        "items": [
+          {
+            "description": "Upgrade the lint config and clear its violations (#671)",
+            "body": "Upgrades `@williamthorsen/eslint-config-typescript`, along with other config packages, and clears lint violations surfaced by the newly activated rules.",
+            "hash": "17124c0ccd1a101d9fc46743b8e6b05d1e639e19"
+          }
+        ]
+      }
+    ]
+  },
+  {
+    "version": "0.15.0",
+    "date": "2026-08-08",
+    "sections": [
+      {
+        "title": "🎉 Features",
+        "audience": "all",
+        "items": [
+          {
+            "description": "Stop reporting absence checks that pass (#610)",
+            "body": "A ReadyUp check that checks for a problem (such as an unwanted file or a stale config reference) now stays silent unless it finds one. The `nmr`, `release-kit`, and `v11y-check` ReadyUp kits previously printed a line for every such check on every run.",
+            "hash": "aa4cbae89dfe4f6268ca4de318213fc3f610aba0"
+          }
+        ]
+      },
+      {
+        "title": "🐛 Bug fixes",
+        "audience": "all",
+        "items": [
+          {
+            "description": "Publish build output atomically so a failed build cannot destroy it (#631)",
+            "body": "Fixes an issue where a failed or still-running `nmr build` could leave a package with no build output at all, breaking the tooling that a subsequent build depends on. Separately, the error reported when a package's build output is missing now names the correct recovery command.",
+            "hash": "79ea249c38dfa265c4be6da57f8a340e54e578b8"
+          }
+        ]
+      },
+      {
+        "title": "⚙️ Tooling",
+        "audience": "dev",
+        "items": [
+          {
+            "description": "Fix lint in v11y-check and clear four deferred lint rules (#620)",
+            "body": "Fixes deferred lint violations in v11y-check package and removes the cap on the severity of four associated rules when a strict-lint check is run.",
+            "hash": "b761f0698962b2bd4acbd0ce9976aebba7244624"
+          },
+          {
+            "description": "Migrate to the shared tsconfig baseline (#626)",
+            "body": "Adopts `@williamthorsen/tsconfig` as the standard TypeScript configuration for this repo, replacing the previous hand-maintained copy. Reading a property through an index signature now requires bracket notation or a type that declares the property. The `nmr` build now fails on a base TypeScript config it cannot resolve, rather than building without it, and it now resolves a base config named by package name alone.",
+            "hash": "890a67c84b99d7efa663f8e64cf0beb89168581b"
+          }
+        ]
+      }
+    ]
+  },
+  {
+    "version": "0.14.2",
+    "date": "2026-08-05",
+    "sections": [
+      {
+        "title": "🧪 Tests",
+        "audience": "dev",
+        "items": [
+          {
+            "description": "Clear the deferred vitest test rules and enforce them (#602)",
+            "body": "Fixes a subset of previously deferred lint violations and restores the severity of Vitest lint rules to \"error\" for purposes strict linting.",
+            "hash": "4b43d29580fe9736fb2b4fa4ae6c2348cca53754"
+          }
+        ]
+      }
+    ]
+  },
+  {
+    "version": "0.14.1",
+    "date": "2026-08-04",
+    "sections": [
+      {
+        "title": "Dependency updates",
+        "audience": "dev",
+        "items": [{ "description": "Bumped `@williamthorsen/nmr-core` to 0.9.1" }]
+      }
+    ]
+  },
+  {
+    "version": "0.14.0",
+    "date": "2026-08-04",
+    "sections": [
+      {
+        "title": "🎉 Features",
+        "audience": "all",
+        "items": [
+          {
+            "description": "Publish each package's readyup kit from the package that owns it (#590)",
+            "body": "ReadyUp checks for `@williamthorsen/nmr`, `@williamthorsen/release-kit`, and `v11y-check` are now run directly against these packages, guaranteeing a version-appropriate check, instead of against their host repo. The package must be installed as a direct dependency in the calling repo.\n\nThe syntax is `rdy run --from npm:<package>`. `rdy run --packages` runs the kits contained in any packages listed in `.config/readyup.config.ts`. Requires `readyup` 0.23 or later.",
+            "hash": "f0fa3b416564ed4490c48007453fcb20c04807b3"
+          }
+        ]
+      }
+    ]
+  },
+  {
+    "version": "0.13.0",
+    "date": "2026-08-03",
+    "sections": [
+      {
+        "title": "🎉 Features",
+        "audience": "all",
+        "items": [
+          {
+            "description": "Publish nmr's readyup kit with a test-tier conformance check (#580)",
+            "body": "`@williamthorsen/nmr` is now bundled with ReadyUp kits that check a repo's alignment with `nmr` requirements and recommendations.\n\n`rdy run --from npm:@williamthorsen/nmr` checks the repo against the kits without prior configuration. Once the package is added to the ReadyUp config, `rdy run --packages` will run the `nmr` kits along with those of any other registered package. Requires `readyup` v0.23 or greater.",
+            "hash": "94bd46acfecf87d6ec0f981ee561c0ebf22d9c09"
+          }
+        ]
+      }
+    ]
+  },
+  {
+    "version": "0.12.0",
+    "date": "2026-08-03",
+    "sections": [
+      {
+        "title": "🎉 Features",
+        "audience": "all",
+        "items": [
+          {
+            "description": "Retire integration label in favor of an isolation-tier test ladder (#552)",
+            "body": "Test groups are now named for what a test reaches rather than for how much of the codebase it covers: `integration` and `app` are replaced by `unit`, `tool`, `localhost`, and `remote`.\n\n`nmr test` now runs the `tool` group alongside `unit`, so the first run after upgrading may fail on tests that nothing was running before. Upgrading means renaming `*.int.test.ts` files onto the new groups and replacing `nmr test:integration` with `nmr test:tool`.",
+            "breaking": true,
+            "hash": "81f16694dc295c754d35e692eedd75f47be35f4d"
+          }
+        ]
+      },
+      {
+        "title": "♻️ Refactoring",
+        "audience": "dev",
+        "items": [
+          {
+            "description": "Share nmr-core's cache primitives with nmr-compile (#570)",
+            "body": "A package's writes to the build cache are now hidden from other packages until the write is complete. A failing build now reports its error in the same form as every other `nmr` command. `tsx` is no longer required to build a package.",
+            "hash": "2a67cf1e6181cb8713de485859c3731e16edacf6"
+          }
+        ]
+      }
+    ]
+  },
+  {
+    "version": "0.11.3",
+    "date": "2026-07-30",
+    "sections": [
+      {
+        "title": "⚙️ Tooling",
+        "audience": "dev",
+        "items": [
+          {
+            "description": "Adopt Vitest projects in this repo (#530)",
+            "body": "Simplifies test configurations so that every package exposes the same test commands, which select suites by test category: `nmr test` runs everything except integration tests, `nmr test:integration` runs only those, and `nmr test:all` runs both. `nmr test:integration` now succeeds in a package that has no integration tests instead of failing. release-kit's drift checks can now be run on their own, apart from unit and integration tests. A fresh clone now has to run `pnpm run bootstrap` before any test run, not just before `nmr` commands.",
+            "hash": "a2fdd9c03c419f8fb70941ff5a3c580a6badcde6"
+          }
+        ]
+      }
+    ]
+  },
+  {
+    "version": "0.11.1",
+    "date": "2026-07-22",
+    "sections": [
+      {
+        "title": "📦 Dependencies",
+        "audience": "dev",
+        "items": [
+          {
+            "description": "Upgrade dependencies and align the Node support policy (#483)",
+            "body": "All four published packages (`nmr`, `nmr-core`, `release-kit`, and `v11y-check`) now require Node.js 24 or later, up from Node 18.17. Separately, `nmr-compile` now rebuilds when the TypeScript version changes.",
+            "hash": "3090aa1ec68224f88e0b537ae09282e8e636f711"
+          }
+        ]
+      }
+    ]
+  },
+  {
+    "version": "0.11.0",
+    "date": "2026-07-13",
+    "sections": [
+      {
+        "title": "🎉 Features",
+        "audience": "all",
+        "items": [
+          {
+            "description": "Fail a package that declares types but ships none (#467)",
+            "body": "`nmr attw` now fails a package that claims to ship type declarations but ships none. Such a package used to pass, leaving every TypeScript consumer of it silently typed as `any`.\n\n  A package that ships working declarations found only by sitting beside its JavaScript entry point escapes the check, since it declares nothing. Add a `types` entry to bring it under the check.",
+            "breaking": true,
+            "hash": "8ccea9d93cd63a7963a7a7516e20f8d54069bd7b"
+          }
+        ]
+      }
+    ]
+  },
+  {
+    "version": "0.10.0",
+    "date": "2026-07-01",
+    "sections": [
+      {
+        "title": "🎉 Features",
+        "audience": "all",
+        "items": [
+          {
+            "description": "Rebuild nmr-compile on a unified tsc emit (#455)",
+            "body": "`nmr` now compiles a package's JavaScript and type declarations in one step, rewriting every import form — static, re-export, dynamic `import()`, bare side-effect, and tsconfig `paths` aliases — to runnable `.js` in both outputs. It now requires TypeScript 5.7 or newer as a peer dependency.",
+            "breaking": true,
+            "hash": "0e55822c88cad341f90b052b15fb9af41e7ae414"
+          }
+        ]
+      }
+    ]
+  },
+  {
+    "version": "0.9.0",
+    "date": "2026-06-30",
+    "sections": [
+      {
+        "title": "🎉 Features",
+        "audience": "all",
+        "items": [
+          {
+            "description": "Rewrite parseArgs on node:util with typed error and exit API (#428)",
+            "body": "`@williamthorsen/nmr-core` gains a typed error API for CLI parsing: `parseArgsOrExit` (parse, or print a usage error and exit) and `ParseError` replace the per-command boilerplate, so every bundled CLI reports a flag mistake the same way. Breaking: the `translateParseError` export is removed and `parseArgs` now throws `ParseError`.",
+            "breaking": true,
+            "hash": "5629bef8f645485b401a04f06ff9153ef5472282"
+          },
+          {
+            "description": "Auto-activate integration test variant from config presence (#448)",
+            "body": "A package can now separate its integration tests from its standalone suite simply by including a `vitest.integration.config.ts` (alongside a `vitest.standalone.config.ts`). The `--int-test` flag that previously enabled this is removed — that config-file pairing is now the only way to activate the separation. In such a package, `test` and `test:coverage` run only the standalone suite and skip integration tests, while a new `test:all` runs both suites together. The separation now holds even when tests run across every package at once, so a full-workspace `test` run still keeps integration tests out of the default suite. Packages that previously hand-copied these test scripts no longer need to.",
+            "breaking": true,
+            "hash": "ee320b913ef1d7255c78eef6fc9ab3b9e94dfd39"
+          }
+        ]
+      },
+      {
+        "title": "🐛 Bug fixes",
+        "audience": "all",
+        "items": [
+          {
+            "description": "Prevent CLI output truncation when piped before exit (#446)",
+            "body": "Fixes an issue where large output from the `nmr` and `v11y` commands could be truncated when captured through a pipe — for example, by a CI job.",
+            "hash": "fa7eeb12c1739b4bce3a73d9143cea4dd967b291"
+          }
+        ]
+      },
+      {
+        "title": "♻️ Refactoring",
+        "audience": "dev",
+        "items": [
+          {
+            "description": "Route all CLI error reporting through a single stderr helper (#437)",
+            "body": "Consolidates error reporting across the CLIs so every command reports errors the same way, and guards against the previous inconsistency returning. The error messages and exit codes users see are unchanged.",
+            "hash": "63e36b3f80bd8858e940362ea2914cb9a19fd821"
+          }
+        ]
+      }
+    ]
+  },
+  {
+    "version": "0.8.0",
+    "date": "2026-06-27",
+    "sections": [
+      {
+        "title": "🎉 Features",
+        "audience": "all",
+        "items": [
+          {
+            "description": "Centralize the per-package build as an nmr-compile bin (#419)",
+            "body": "Introduces `nmr-compile`, a single command shipped with `@williamthorsen/nmr` that compiles each workspace package and now backs the default build. Consuming repos can delete their own per-package build script and pick up future build fixes just by upgrading nmr. Repeated builds with unchanged source now reliably skip recompiling instead of occasionally rebuilding for no reason, and import aliases now resolve correctly in symlinked checkouts.",
+            "hash": "cc20e3130087689c2fe8bf0e6de4b1349646296e"
+          }
+        ]
+      }
+    ]
+  },
+  {
+    "version": "0.7.1",
+    "date": "2026-05-19",
+    "sections": [
+      {
+        "title": "♻️ Refactoring",
+        "audience": "dev",
+        "items": [
+          {
+            "description": "Restructure tests and align core package directory with package name (#405)",
+            "body": "Tests in every package are now typechecked alongside the code they cover, so type breakage in tests fails the build instead of slipping through. The `core` package's workspace directory is renamed to match its package name, so `nmr -F nmr-core ...` and `pnpm --filter nmr-core ...` now resolve where they previously failed.",
+            "hash": "91006ec4281be902d66dfdef3917f603ee56b5c3"
+          }
+        ]
+      }
+    ]
+  },
+  {
+    "version": "0.7.0",
+    "date": "2026-05-10",
+    "sections": [
+      {
+        "title": "🎉 Features",
+        "audience": "all",
+        "items": [
+          {
+            "description": "Rename audit-deps to v11y-check (#383)",
+            "body": "The package previously published as `@williamthorsen/audit-deps` has been renamed to `v11y-check`. The CLI command is now `v11y-check`, and the default config file is `.config/v11y-check.config.json`. Existing users should install `v11y-check` in place of `@williamthorsen/audit-deps`, rename their config file, and update any scripts that invoke `audit-deps`. Behavior is unchanged.",
+            "hash": "1ce3d2f915d39eba52f1792b44ad02d21deafba5"
+          }
+        ]
+      }
+    ]
+  },
+  {
+    "version": "0.6.1",
+    "date": "2026-05-04",
+    "sections": [
+      {
+        "title": "♻️ Refactoring",
+        "audience": "dev",
+        "items": [
+          {
+            "description": "Read package version at runtime via shared helper (#338)",
+            "body": "Fixes an issue where running `audit-deps`, `nmr`, or `release-kit` from the locally built `dist/esm/` after a `git pull` could report a stale version. Each CLI now reads its version directly from its `package.json` at startup, so version reads stay in sync with the installed source without requiring a fresh `pnpm install` or rebuild."
+          }
+        ]
+      },
+      {
+        "title": "📚 Documentation",
+        "audience": "dev",
+        "items": [
+          {
+            "description": "Clarify which vulnerabilities `audit-deps sync` adds (#363)",
+            "body": "Clarifies the action hints printed by `audit-deps check` so users understand exactly which vulnerabilities `audit-deps sync` will allowlist. The hints now read \"add **the listed** vulnerabilities to the allowlist\", tying the action to the report shown immediately above. The previous wording — \"add vulnerabilities to the allowlist\" — could imply that `sync` is selective or interactive, when in fact it non-interactively allowlists every unallowed vulnerability in the report."
+          }
+        ]
+      }
+    ]
+  },
+  {
+    "version": "0.6.0",
+    "date": "2026-04-30",
+    "sections": [
+      {
+        "title": "🎉 Features",
+        "audience": "all",
+        "items": [
+          {
+            "description": "Add status indicator to standing-issue title (#335)",
+            "body": "Adds a status indicator and bot-origin emoji to the standing issue maintained by the dependency-audit workflow. The title now reflects the most severe finding category and is refreshed on every run — `🤖 Dependency audit status: 3 vulnerabilities found 🚨`, `🤖 Dependency audit status: no vulnerabilities ✅`, and so on. Status priority is severity-driven: unallowed vulnerabilities outrank suppressed entries, which outrank stale allowlist entries."
+          }
+        ]
+      }
+    ]
+  },
+  {
+    "version": "0.5.0",
+    "date": "2026-04-23",
+    "sections": [
+      {
+        "title": "🎉 Features",
+        "audience": "all",
+        "items": [
+          {
+            "description": "Show below-threshold vulnerabilities and threshold in check output (#244)",
+            "body": "Surfaces below-threshold vulnerabilities in the check command's output instead of silently hiding them. When the severity threshold is above `low`, vulnerabilities that fall below it now appear with an `ℹ️` marker and \"ignored\" annotation in bare output, full advisory detail in verbose output, and a distinct `belowThreshold` array in JSON output. Scope headers display the active threshold (e.g., `📦 prod (threshold: 🟠 moderate):`) so users can see what filtering is in effect. The \"No known vulnerabilities found\" message now only appears when there are truly zero vulnerabilities across all categories. Exit code behavior is unchanged — only above-threshold, non-allowlisted vulnerabilities cause failure."
+          },
+          {
+            "description": "Replace --only with --tags on release-kit publish and push (#273)",
+            "body": "`release-kit publish` and `release-kit push` now filter by full tag name via `--tags=<tag1,tag2>` instead of workspace directory name via `--only=<dir>`, matching the shape already used by `create-github-release`. Callers pass the tag they care about (e.g., `core-v1.3.0`) directly, with no translation step back to the publishing workspace's directory name. The reusable workflow gains an optional `tags:` input, and the internal `publish.yaml` caller now passes `tags: ${{ github.ref_name }}`, making the publish scope explicit rather than relying on the single-tag fetch default of `actions/checkout@v6`.",
+            "breaking": true
+          },
+          {
+            "description": "Scaffold audit.yaml workflow from audit-deps init (#277)",
+            "body": "Adds GitHub Actions workflow scaffolding to `audit-deps init`. Running the command now writes both `.config/audit-deps.config.json` and `.github/workflows/audit.yaml` in the target repo, so that consumers no longer have to copy the canonical caller workflow by hand from this repo. The workflow content is shipped as a bundled template that ships to npm, and the repo's own workflow is kept byte-identical to that template via a consistency test — the canonical workflow cannot silently drift from what is published."
+          }
+        ]
+      },
+      {
+        "title": "♻️ Refactoring",
+        "audience": "dev",
+        "items": [
+          {
+            "description": "Rename `node-monorepo-core` to `nmr-core` (#304)",
+            "body": "Renames the shared-utilities package from `@williamthorsen/node-monorepo-core` to `@williamthorsen/nmr-core`, aligning it with the repository's `nmr-*` naming convention. The package's functionality and version are unchanged; only the published name differs.",
+            "breaking": true
+          }
+        ]
+      }
+    ]
+  },
+  {
+    "version": "0.4.0",
+    "date": "2026-04-17",
+    "sections": [
+      {
+        "title": "🎉 Features",
+        "audience": "all",
+        "items": [
+          {
+            "description": "Allow audit-deps to work without a config (#235)",
+            "body": "Adds a no-config mode to `audit-deps` so `npx @williamthorsen/audit-deps` produces a useful vulnerability report in any repo without requiring a config file. Replaces the four confusing severity booleans with a single `severityThreshold` field: `critical`, `high`, `moderate`, or `low`. Adds a JSON Schema to the generated configs."
+          },
+          {
+            "description": "Store full ISO 8601 datetime in `addedAt` (#236)",
+            "body": "Replaces the ambiguous `YYYY-MM-DD` date-only string in allowlist `addedAt` fields with a full ISO 8601 UTC datetime (e.g., `2026-04-15T14:30:00.000Z`). This removes timezone ambiguity and adds time-of-day precision for more accurate relative-time display."
+          },
+          {
+            "description": "Improve DX of audit-deps bare output (#241)",
+            "body": "Redesigns the `audit-deps` bare output format to show GHSA IDs instead of npm-specific numeric advisory IDs, add severity text labels, and guide developers toward next steps. The new format includes an intro banner reflecting the audit scope, scope-labeled sections with emoji markers, bulleted findings with severity indicators, relative-time annotations on allowed vulnerabilities, and a unified `Actions:` footer with context-aware verbose and sync hints. Extracts shared time-formatting helpers into a dedicated module to support relative timestamps in both bare and verbose formatters."
+          }
+        ]
+      }
+    ]
+  },
+  {
+    "version": "0.3.0",
+    "date": "2026-04-16",
+    "sections": [
+      {
+        "title": "🎉 Features",
+        "audience": "all",
+        "items": [
+          {
+            "description": "Decouple audit from CI quality gate and add audit workflow (#210)",
+            "body": "Dependency audit is now decoupled from the CI quality gate so that transient upstream CVEs no longer block the merging of unrelated code changes. Audit now runs in a dedicated workflow with non-blocking PR integration (acknowledgment checkbox) and a daily scheduled run that tracks results in a standing GitHub issue. A readyup kit is available to validate the new setup in consuming repos."
+          },
+          {
+            "description": "Replace bare-command help with grouped check (#211)",
+            "body": "The bare `audit-deps` command now runs a grouped vulnerability check instead of showing help text. Each scope (prod first, then dev) shows unallowed vulnerabilities with severity indicators, allowed vulnerabilities with annotations, and stale allowlist entries flagged for cleanup. Exit code is 1 when unallowed vulnerabilities exist.\n\nThe previous raw audit-ci passthrough moves behind `--raw`. The `report` subcommand is removed; its functionality is superseded by the new default output. `--dev`/`--prod`, `--config`, and `--json` compose with both the bare command and `--raw`.\n\n- Add optional `severity` field to `AuditResult` and extract it from audit-ci advisory JSON.\n- Add `checkCommand` that cross-references audit results with the config allowlist to classify vulnerabilities and detect stale entries. Forward `runReport` stderr to `process.stderr` when non-empty, matching the existing `auditCommand` pattern.\n- Add `formatCheckText` and `formatCheckJson` formatters in `format-check.ts`, with severity-to-emoji mapping (🔴 critical/high, 🟠 moderate, 🟡 low/info).\n- Extract `generateScopeConfig` to deduplicate the `generateAuditCiConfig` try/catch error-wrapping shared by `checkCommand`, `syncCommand`, and `loadAndGenerate`.\n- Route bare invocation to `checkCommand`, `--raw` to `auditCommand`.\n- Remove `reportCommand`, `showReportHelp`, and `report` from `SUBCOMMANDS`.\n- Update help text to document `--raw` and the new default behavior.\n- Cover new and modified behavior with unit tests, including severity parsing, formatter output, `checkCommand` classification and exit codes, stale-entry detection, stderr forwarding, scope ordering, and `--raw` routing."
+          },
+          {
+            "description": "Verbose check output for audit-deps (#213)",
+            "body": "Adds a `--verbose` / `-v` flag to the default `audit-deps` check that produces a detailed per-vulnerability report — advisory title, severity, every affected dependency path, link, and description — replacing the need to chase the URL for each finding. Both bare and verbose outputs gain an `Actions:` footer that tells the user exactly which `audit-deps sync` invocation will resolve the current state, and `sync` now stamps an `addedAt` date on allowlist entries so allowed vulnerabilities carry an `allowed X ago (YYYY-MM-DD)` line when displayed in verbose mode."
+          }
+        ]
+      },
+      {
+        "title": "📚 Documentation",
+        "audience": "dev",
+        "items": [
+          {
+            "description": "Align README and help text with current CLI API",
+            "body": "Update the Quick start and CLI reference in the `audit-deps` README to match the grouped-check default, the removal of the `report` command, and the new `--raw` flag. Remove \"(CI mode)\" from the `--raw` help-text description; the flag is not tied to CI environments."
+          }
+        ]
+      }
+    ]
+  },
+  {
+    "version": "0.2.1",
+    "date": "2026-04-15",
+    "sections": [
+      {
+        "title": "⚙️ Tooling",
+        "audience": "dev",
+        "items": [
+          {
+            "description": "Enable automated publication to npm (#187)",
+            "body": "Prepares the repository for reliable tag-triggered npm publishing by adding missing package metadata, standardizing licensing, and introducing a readyup kit that validates publish readiness across all packages."
+          }
+        ]
+      }
+    ]
+  },
+  {
+    "version": "0.2.0",
+    "date": "2026-04-10",
+    "sections": [
+      {
+        "title": "🎉 Features",
+        "audience": "all",
+        "items": [
+          {
+            "description": "Create audit-deps wrapper to manage dependency audits (#183)",
+            "body": "Adds a new `@williamthorsen/audit-deps` package that wraps `audit-ci` with a typed JSON config model, per-scope (dev/prod) severity thresholds, and a sync workflow that automates allowlist management. The package provides a CLI with five commands: default audit (CI pass/fail), `report` (all vulnerabilities), `sync` (diff-based allowlist updates), `generate` (flat config regeneration), and `init` (config scaffolding)."
+          }
+        ]
+      }
+    ]
+  }
+]

package/.readyup/kits/default.js

@@ -63,7 +63,7 @@ var default_default = defineRdyKit({
   ]
 });
 function getMinVersion() {
-  const picked = { "version": "0.15.8" };
+  const picked = { "version": "0.16.0" };
   if (typeof picked["version"] !== "string") {
     throw new TypeError("v11y-check/package.json: 'version' must be a string");
   }

package/.readyup/manifest.json

@@ -13,7 +13,7 @@
           "path": "kits/default.ts"
         },
         {
-          "hash": "2c9cf983",
+          "hash": "85008b8a",
           "kind": "inline",
           "path": "../package.json",
           "paths": [
@@ -26,7 +26,7 @@
       "readyupVersion": "0.35.0",
       "source": "kits/default.ts",
       "sourceHash": "52754bbb",
-      "targetHash": "6d9f65b0"
+      "targetHash": "7de75704"
     }
   ]
 }

package/CHANGELOG.md

@@ -0,0 +1,375 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+## 0.16.0 — 2026-09-08
+
+### 🎉 Features
+
+- Report a package whose tarball would omit its changelog (#768)
+
+  Adds ReadyUp checks to verify that every published package bundles its changelog files: the human-readable `CHANGELOG.md` and the machine-readable `changelog.json`.
+
+### 🧪 Tests
+
+- Read console spy output with listConsoleLines rather than by hand (#781)
+
+  - Replaces the hand-rolled reads of a console spy's `mock.calls` in the `nmr`, `release-kit`, and `v11y-check` test suites with `listConsoleLines` from `@williamthorsen/toolbelt.vitest/candidate`.
+  - Clears the `toolbelt.vitest/no-console-calls-read` recommendation that `rdy run --packages` reported.
+
+## 0.15.8 — 2026-09-01
+
+### ♻️ Refactoring
+
+- Upgrade to readyup v0.34 and exclude a private repo root from kit checks (#759)
+
+  Upgrades `readyup` to v0.34, whose `discoverWorkspaces` now reports the repo root. `release-kit`'s `npm-auto-publish` kit filters that root out unless it is publishable, so a private root is no longer listed in the kit's report.
+
+  Test suites for release-kit's ReadyUp kits have been refactored to use the patterns documented in v0.34.
+
+### ⚙️ Tooling
+
+- Restrict node:fs scaffolding in test code to the temporary tree's API (#756)
+
+  Adds an ESLint restriction that flags the `node:fs` and `node:fs/promises` calls that scaffold a temporary directory in test code instead of using the `TempTree` API. Also migrates `v11y-check`'s `node:fs/promises` scaffolding to that API.
+
+## 0.15.7 — 2026-08-24
+
+### ♻️ Refactoring
+
+- Upgrade ReadyUp and the toolbelt packages, adopting their new APIs (#748)
+
+  Upgrades `readyup` and the `@williamthorsen/toolbelt.*` packages to their latest versions.
+
+  The `readFile` utility from `readyup` replaces hand-rolled code in `nmr`.
+
+### 🧪 Tests
+
+- Scaffold the nmr-core, root, and v11y-check trees through the write API (#734)
+
+  Converts the `node:fs` scaffolding in five test suites across `nmr-core`, the repo root, and `v11y-check` to the temporary tree's own write API, which refuses a path that escapes the tree. Fixture helpers in `hashWorkingTree.tool.test.ts` and `init.unit.test.ts` take the tree itself in place of a captured directory string.
+
+## 0.15.6 — 2026-08-20
+
+### 🧪 Tests
+
+- Register the working directory for disposal alongside the tree it points into (#724)
+
+  Converts the `release-kit` and `v11y-check` suites that run from inside a temporary directory to `createTempTree` and `pointCwdAt`, registered through `disposeOnTestFinished` or scoped with `using`. Reverse-order disposal now restores the working directory before removing the tree it pointed into, which each suite previously had to sequence by hand.
+
+- Route the remaining hand-built temporary directories through createTempTree (#725)
+
+  Replaces the hand-built temporary directories in the `release-kit` and `v11y-check` test suites with a `createTempTree` fixture, dropping the `beforeEach`/`afterEach` pairs that created and removed them.
+
+## 0.15.5 — 2026-08-19
+
+### 🧪 Tests
+
+- Register fixture-repo cleanup against the test that asks for it (#715)
+
+  Routes nmr's `buildRepo` fixture helper through `createTempTree`, registering each fixture directory's removal against the test that requested it. The module-level accumulator and the exported `removeFixtureDirs` have been removed.
+
+## 0.15.3 — 2026-08-17
+
+### ♻️ Refactoring
+
+- Adopt silenceConsole across the test suites (#677)
+
+  Adopts `silenceConsole` from `@williamthorsen/toolbelt.vitest` to replace all hand-rolled `vi.spyOn(console, …)` spies and reduce boilerplate across the repo's test suites. The function returns a disposable, allowing the caller to use `using` to enable restoration of the console method at the end of the test scope.
+
+### 🧪 Tests
+
+- Replace the stdio spies with captureStdio (#678)
+
+  Replaces every `process.stdout` and `process.stderr` spy in the test suites with `captureStdio` from `@williamthorsen/toolbelt.testing` and deletes the obviated local capture helpers. `captureStdio` buffers writes rather than recording calls, so assertions that previously used `toHaveBeenCalledWith` instead check `stderr`/`stdout` strings and their chunk arrays.
+
+  Separately, `unicorn/no-nonstandard-builtin-properties` is off for test files. Its hand-maintained symbol table omits `Symbol.dispose`, which a suite-scoped capture calls to restore the streams, and `schema: []` offers no way to extend the table.
+
+### 👷 CI
+
+- Migrate the reusable workflows to pnpm/setup (#687)
+
+  Migrates the four reusable workflows from `pnpm/action-setup` to `pnpm/setup`, which installs pnpm as a native standalone binary and can supply the JavaScript runtime in the same step. `audit`, `create-github-release`, and `publish` now set up in one step with no `actions/setup-node`; `release` keeps it, because `pnpm/setup` omits `npm` and `npx` from the runtime it installs while `release-kit prepare` spawns `npx git-cliff` and `npx prettier`.
+
+  Migration: consumers of `audit`, `create-github-release`, and `publish` need a `devEngines.packageManager` or `packageManager` field pinning pnpm 11 or newer, the only range `pnpm/setup` installs. `create-github-release` and `publish` additionally need `@williamthorsen/release-kit` as a root dependency, because they now invoke it through `pnpm exec` instead of `npx --yes`.
+
+## 0.15.2 — 2026-08-13
+
+### ♻️ Refactoring
+
+- Adopt toolbelt.errors for error-message extraction and cause-chaining (#652)
+
+  Improves error reporting by adopting standardized ways of capturing and describing errors across the codebase.
+
+### ⚙️ Tooling
+
+- Upgrade the lint config and clear its violations (#671)
+
+  Upgrades `@williamthorsen/eslint-config-typescript`, along with other config packages, and clears lint violations surfaced by the newly activated rules.
+
+## 0.15.0 — 2026-08-08
+
+### 🎉 Features
+
+- Stop reporting absence checks that pass (#610)
+
+  A ReadyUp check that checks for a problem (such as an unwanted file or a stale config reference) now stays silent unless it finds one. The `nmr`, `release-kit`, and `v11y-check` ReadyUp kits previously printed a line for every such check on every run.
+
+### 🐛 Bug fixes
+
+- Publish build output atomically so a failed build cannot destroy it (#631)
+
+  Fixes an issue where a failed or still-running `nmr build` could leave a package with no build output at all, breaking the tooling that a subsequent build depends on. Separately, the error reported when a package's build output is missing now names the correct recovery command.
+
+### ⚙️ Tooling
+
+- Fix lint in v11y-check and clear four deferred lint rules (#620)
+
+  Fixes deferred lint violations in v11y-check package and removes the cap on the severity of four associated rules when a strict-lint check is run.
+
+- Migrate to the shared tsconfig baseline (#626)
+
+  Adopts `@williamthorsen/tsconfig` as the standard TypeScript configuration for this repo, replacing the previous hand-maintained copy. Reading a property through an index signature now requires bracket notation or a type that declares the property. The `nmr` build now fails on a base TypeScript config it cannot resolve, rather than building without it, and it now resolves a base config named by package name alone.
+
+## 0.14.2 — 2026-08-05
+
+### 🧪 Tests
+
+- Clear the deferred vitest test rules and enforce them (#602)
+
+  Fixes a subset of previously deferred lint violations and restores the severity of Vitest lint rules to "error" for purposes strict linting.
+
+## 0.14.1 — 2026-08-04
+
+### Dependency updates
+
+- Bumped `@williamthorsen/nmr-core` to 0.9.1
+
+## 0.14.0 — 2026-08-04
+
+### 🎉 Features
+
+- Publish each package's readyup kit from the package that owns it (#590)
+
+  ReadyUp checks for `@williamthorsen/nmr`, `@williamthorsen/release-kit`, and `v11y-check` are now run directly against these packages, guaranteeing a version-appropriate check, instead of against their host repo. The package must be installed as a direct dependency in the calling repo.
+
+  The syntax is `rdy run --from npm:<package>`. `rdy run --packages` runs the kits contained in any packages listed in `.config/readyup.config.ts`. Requires `readyup` 0.23 or later.
+
+## 0.13.0 — 2026-08-03
+
+### 🎉 Features
+
+- Publish nmr's readyup kit with a test-tier conformance check (#580)
+
+  `@williamthorsen/nmr` is now bundled with ReadyUp kits that check a repo's alignment with `nmr` requirements and recommendations.
+
+  `rdy run --from npm:@williamthorsen/nmr` checks the repo against the kits without prior configuration. Once the package is added to the ReadyUp config, `rdy run --packages` will run the `nmr` kits along with those of any other registered package. Requires `readyup` v0.23 or greater.
+
+## 0.12.0 — 2026-08-03
+
+### 🎉 Features
+
+- 🚨 **Breaking:** Retire integration label in favor of an isolation-tier test ladder (#552)
+
+  Test groups are now named for what a test reaches rather than for how much of the codebase it covers: `integration` and `app` are replaced by `unit`, `tool`, `localhost`, and `remote`.
+
+  `nmr test` now runs the `tool` group alongside `unit`, so the first run after upgrading may fail on tests that nothing was running before. Upgrading means renaming `*.int.test.ts` files onto the new groups and replacing `nmr test:integration` with `nmr test:tool`.
+
+### ♻️ Refactoring
+
+- Share nmr-core's cache primitives with nmr-compile (#570)
+
+  A package's writes to the build cache are now hidden from other packages until the write is complete. A failing build now reports its error in the same form as every other `nmr` command. `tsx` is no longer required to build a package.
+
+## 0.11.3 — 2026-07-30
+
+### ⚙️ Tooling
+
+- Adopt Vitest projects in this repo (#530)
+
+  Simplifies test configurations so that every package exposes the same test commands, which select suites by test category: `nmr test` runs everything except integration tests, `nmr test:integration` runs only those, and `nmr test:all` runs both. `nmr test:integration` now succeeds in a package that has no integration tests instead of failing. release-kit's drift checks can now be run on their own, apart from unit and integration tests. A fresh clone now has to run `pnpm run bootstrap` before any test run, not just before `nmr` commands.
+
+## 0.11.1 — 2026-07-22
+
+### 📦 Dependencies
+
+- Upgrade dependencies and align the Node support policy (#483)
+
+  All four published packages (`nmr`, `nmr-core`, `release-kit`, and `v11y-check`) now require Node.js 24 or later, up from Node 18.17. Separately, `nmr-compile` now rebuilds when the TypeScript version changes.
+
+## 0.11.0 — 2026-07-13
+
+### 🎉 Features
+
+- 🚨 **Breaking:** Fail a package that declares types but ships none (#467)
+
+  `nmr attw` now fails a package that claims to ship type declarations but ships none. Such a package used to pass, leaving every TypeScript consumer of it silently typed as `any`.
+
+  A package that ships working declarations found only by sitting beside its JavaScript entry point escapes the check, since it declares nothing. Add a `types` entry to bring it under the check.
+
+## 0.10.0 — 2026-07-01
+
+### 🎉 Features
+
+- 🚨 **Breaking:** Rebuild nmr-compile on a unified tsc emit (#455)
+
+  `nmr` now compiles a package's JavaScript and type declarations in one step, rewriting every import form — static, re-export, dynamic `import()`, bare side-effect, and tsconfig `paths` aliases — to runnable `.js` in both outputs. It now requires TypeScript 5.7 or newer as a peer dependency.
+
+## 0.9.0 — 2026-06-30
+
+### 🎉 Features
+
+- 🚨 **Breaking:** Rewrite parseArgs on node:util with typed error and exit API (#428)
+
+  `@williamthorsen/nmr-core` gains a typed error API for CLI parsing: `parseArgsOrExit` (parse, or print a usage error and exit) and `ParseError` replace the per-command boilerplate, so every bundled CLI reports a flag mistake the same way. Breaking: the `translateParseError` export is removed and `parseArgs` now throws `ParseError`.
+
+- 🚨 **Breaking:** Auto-activate integration test variant from config presence (#448)
+
+  A package can now separate its integration tests from its standalone suite simply by including a `vitest.integration.config.ts` (alongside a `vitest.standalone.config.ts`). The `--int-test` flag that previously enabled this is removed — that config-file pairing is now the only way to activate the separation. In such a package, `test` and `test:coverage` run only the standalone suite and skip integration tests, while a new `test:all` runs both suites together. The separation now holds even when tests run across every package at once, so a full-workspace `test` run still keeps integration tests out of the default suite. Packages that previously hand-copied these test scripts no longer need to.
+
+### 🐛 Bug fixes
+
+- Prevent CLI output truncation when piped before exit (#446)
+
+  Fixes an issue where large output from the `nmr` and `v11y` commands could be truncated when captured through a pipe — for example, by a CI job.
+
+### ♻️ Refactoring
+
+- Route all CLI error reporting through a single stderr helper (#437)
+
+  Consolidates error reporting across the CLIs so every command reports errors the same way, and guards against the previous inconsistency returning. The error messages and exit codes users see are unchanged.
+
+## 0.8.0 — 2026-06-27
+
+### 🎉 Features
+
+- Centralize the per-package build as an nmr-compile bin (#419)
+
+  Introduces `nmr-compile`, a single command shipped with `@williamthorsen/nmr` that compiles each workspace package and now backs the default build. Consuming repos can delete their own per-package build script and pick up future build fixes just by upgrading nmr. Repeated builds with unchanged source now reliably skip recompiling instead of occasionally rebuilding for no reason, and import aliases now resolve correctly in symlinked checkouts.
+
+## 0.7.1 — 2026-05-19
+
+### ♻️ Refactoring
+
+- Restructure tests and align core package directory with package name (#405)
+
+  Tests in every package are now typechecked alongside the code they cover, so type breakage in tests fails the build instead of slipping through. The `core` package's workspace directory is renamed to match its package name, so `nmr -F nmr-core ...` and `pnpm --filter nmr-core ...` now resolve where they previously failed.
+
+## 0.7.0 — 2026-05-10
+
+### 🎉 Features
+
+- Rename audit-deps to v11y-check (#383)
+
+  The package previously published as `@williamthorsen/audit-deps` has been renamed to `v11y-check`. The CLI command is now `v11y-check`, and the default config file is `.config/v11y-check.config.json`. Existing users should install `v11y-check` in place of `@williamthorsen/audit-deps`, rename their config file, and update any scripts that invoke `audit-deps`. Behavior is unchanged.
+
+## 0.6.1 — 2026-05-04
+
+### ♻️ Refactoring
+
+- Read package version at runtime via shared helper (#338)
+
+  Fixes an issue where running `audit-deps`, `nmr`, or `release-kit` from the locally built `dist/esm/` after a `git pull` could report a stale version. Each CLI now reads its version directly from its `package.json` at startup, so version reads stay in sync with the installed source without requiring a fresh `pnpm install` or rebuild.
+
+### 📚 Documentation
+
+- Clarify which vulnerabilities `audit-deps sync` adds (#363)
+
+  Clarifies the action hints printed by `audit-deps check` so users understand exactly which vulnerabilities `audit-deps sync` will allowlist. The hints now read "add **the listed** vulnerabilities to the allowlist", tying the action to the report shown immediately above. The previous wording — "add vulnerabilities to the allowlist" — could imply that `sync` is selective or interactive, when in fact it non-interactively allowlists every unallowed vulnerability in the report.
+
+## 0.6.0 — 2026-04-30
+
+### 🎉 Features
+
+- Add status indicator to standing-issue title (#335)
+
+  Adds a status indicator and bot-origin emoji to the standing issue maintained by the dependency-audit workflow. The title now reflects the most severe finding category and is refreshed on every run — `🤖 Dependency audit status: 3 vulnerabilities found 🚨`, `🤖 Dependency audit status: no vulnerabilities ✅`, and so on. Status priority is severity-driven: unallowed vulnerabilities outrank suppressed entries, which outrank stale allowlist entries.
+
+## 0.5.0 — 2026-04-23
+
+### 🎉 Features
+
+- Show below-threshold vulnerabilities and threshold in check output (#244)
+
+  Surfaces below-threshold vulnerabilities in the check command's output instead of silently hiding them. When the severity threshold is above `low`, vulnerabilities that fall below it now appear with an `ℹ️` marker and "ignored" annotation in bare output, full advisory detail in verbose output, and a distinct `belowThreshold` array in JSON output. Scope headers display the active threshold (e.g., `📦 prod (threshold: 🟠 moderate):`) so users can see what filtering is in effect. The "No known vulnerabilities found" message now only appears when there are truly zero vulnerabilities across all categories. Exit code behavior is unchanged — only above-threshold, non-allowlisted vulnerabilities cause failure.
+
+- 🚨 **Breaking:** Replace --only with --tags on release-kit publish and push (#273)
+
+  `release-kit publish` and `release-kit push` now filter by full tag name via `--tags=<tag1,tag2>` instead of workspace directory name via `--only=<dir>`, matching the shape already used by `create-github-release`. Callers pass the tag they care about (e.g., `core-v1.3.0`) directly, with no translation step back to the publishing workspace's directory name. The reusable workflow gains an optional `tags:` input, and the internal `publish.yaml` caller now passes `tags: ${{ github.ref_name }}`, making the publish scope explicit rather than relying on the single-tag fetch default of `actions/checkout@v6`.
+
+- Scaffold audit.yaml workflow from audit-deps init (#277)
+
+  Adds GitHub Actions workflow scaffolding to `audit-deps init`. Running the command now writes both `.config/audit-deps.config.json` and `.github/workflows/audit.yaml` in the target repo, so that consumers no longer have to copy the canonical caller workflow by hand from this repo. The workflow content is shipped as a bundled template that ships to npm, and the repo's own workflow is kept byte-identical to that template via a consistency test — the canonical workflow cannot silently drift from what is published.
+
+### ♻️ Refactoring
+
+- 🚨 **Breaking:** Rename `node-monorepo-core` to `nmr-core` (#304)
+
+  Renames the shared-utilities package from `@williamthorsen/node-monorepo-core` to `@williamthorsen/nmr-core`, aligning it with the repository's `nmr-*` naming convention. The package's functionality and version are unchanged; only the published name differs.
+
+## 0.4.0 — 2026-04-17
+
+### 🎉 Features
+
+- Allow audit-deps to work without a config (#235)
+
+  Adds a no-config mode to `audit-deps` so `npx @williamthorsen/audit-deps` produces a useful vulnerability report in any repo without requiring a config file. Replaces the four confusing severity booleans with a single `severityThreshold` field: `critical`, `high`, `moderate`, or `low`. Adds a JSON Schema to the generated configs.
+
+- Store full ISO 8601 datetime in `addedAt` (#236)
+
+  Replaces the ambiguous `YYYY-MM-DD` date-only string in allowlist `addedAt` fields with a full ISO 8601 UTC datetime (e.g., `2026-04-15T14:30:00.000Z`). This removes timezone ambiguity and adds time-of-day precision for more accurate relative-time display.
+
+- Improve DX of audit-deps bare output (#241)
+
+  Redesigns the `audit-deps` bare output format to show GHSA IDs instead of npm-specific numeric advisory IDs, add severity text labels, and guide developers toward next steps. The new format includes an intro banner reflecting the audit scope, scope-labeled sections with emoji markers, bulleted findings with severity indicators, relative-time annotations on allowed vulnerabilities, and a unified `Actions:` footer with context-aware verbose and sync hints. Extracts shared time-formatting helpers into a dedicated module to support relative timestamps in both bare and verbose formatters.
+
+## 0.3.0 — 2026-04-16
+
+### 🎉 Features
+
+- Decouple audit from CI quality gate and add audit workflow (#210)
+
+  Dependency audit is now decoupled from the CI quality gate so that transient upstream CVEs no longer block the merging of unrelated code changes. Audit now runs in a dedicated workflow with non-blocking PR integration (acknowledgment checkbox) and a daily scheduled run that tracks results in a standing GitHub issue. A readyup kit is available to validate the new setup in consuming repos.
+
+- Replace bare-command help with grouped check (#211)
+
+  The bare `audit-deps` command now runs a grouped vulnerability check instead of showing help text. Each scope (prod first, then dev) shows unallowed vulnerabilities with severity indicators, allowed vulnerabilities with annotations, and stale allowlist entries flagged for cleanup. Exit code is 1 when unallowed vulnerabilities exist.
+
+  The previous raw audit-ci passthrough moves behind `--raw`. The `report` subcommand is removed; its functionality is superseded by the new default output. `--dev`/`--prod`, `--config`, and `--json` compose with both the bare command and `--raw`.
+
+  - Add optional `severity` field to `AuditResult` and extract it from audit-ci advisory JSON.
+  - Add `checkCommand` that cross-references audit results with the config allowlist to classify vulnerabilities and detect stale entries. Forward `runReport` stderr to `process.stderr` when non-empty, matching the existing `auditCommand` pattern.
+  - Add `formatCheckText` and `formatCheckJson` formatters in `format-check.ts`, with severity-to-emoji mapping (🔴 critical/high, 🟠 moderate, 🟡 low/info).
+  - Extract `generateScopeConfig` to deduplicate the `generateAuditCiConfig` try/catch error-wrapping shared by `checkCommand`, `syncCommand`, and `loadAndGenerate`.
+  - Route bare invocation to `checkCommand`, `--raw` to `auditCommand`.
+  - Remove `reportCommand`, `showReportHelp`, and `report` from `SUBCOMMANDS`.
+  - Update help text to document `--raw` and the new default behavior.
+  - Cover new and modified behavior with unit tests, including severity parsing, formatter output, `checkCommand` classification and exit codes, stale-entry detection, stderr forwarding, scope ordering, and `--raw` routing.
+
+- Verbose check output for audit-deps (#213)
+
+  Adds a `--verbose` / `-v` flag to the default `audit-deps` check that produces a detailed per-vulnerability report — advisory title, severity, every affected dependency path, link, and description — replacing the need to chase the URL for each finding. Both bare and verbose outputs gain an `Actions:` footer that tells the user exactly which `audit-deps sync` invocation will resolve the current state, and `sync` now stamps an `addedAt` date on allowlist entries so allowed vulnerabilities carry an `allowed X ago (YYYY-MM-DD)` line when displayed in verbose mode.
+
+### 📚 Documentation
+
+- Align README and help text with current CLI API
+
+  Update the Quick start and CLI reference in the `audit-deps` README to match the grouped-check default, the removal of the `report` command, and the new `--raw` flag. Remove "(CI mode)" from the `--raw` help-text description; the flag is not tied to CI environments.
+
+## 0.2.1 — 2026-04-15
+
+### ⚙️ Tooling
+
+- Enable automated publication to npm (#187)
+
+  Prepares the repository for reliable tag-triggered npm publishing by adding missing package metadata, standardizing licensing, and introducing a readyup kit that validates publish readiness across all packages.
+
+## 0.2.0 — 2026-04-10
+
+### 🎉 Features
+
+- Create audit-deps wrapper to manage dependency audits (#183)
+
+  Adds a new `@williamthorsen/audit-deps` package that wraps `audit-ci` with a typed JSON config model, per-scope (dev/prod) severity thresholds, and a sync workflow that automates allowlist management. The package provides a CLI with five commands: default audit (CI pass/fail), `report` (all vulnerabilities), `sync` (diff-based allowlist updates), `generate` (flat config regeneration), and `init` (config scaffolding).
+
+<!-- Generated by release-kit. Do not edit this file. Use .meta/changelog-overrides.json to override entries. -->

package/README.md

@@ -2,7 +2,15 @@
 
 Wraps [audit-ci](https://github.com/IBM/audit-ci) with a richer config model, typed JSON source of truth, and a sync workflow that automates allowlist management.
 
-<!-- section:release-notes --><!-- /section:release-notes -->
+<!-- section:release-notes -->
+## Release notes — v0.16.0 (2026-09-08)
+
+### 🎉 Features
+
+- Report a package whose tarball would omit its changelog (#768)
+
+  Adds ReadyUp checks to verify that every published package bundles its changelog files: the human-readable `CHANGELOG.md` and the machine-readable `changelog.json`.
+<!-- /section:release-notes -->
 
 ## Installation
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "v11y-check",
-  "version": "0.15.8",
+  "version": "0.16.0",
   "private": false,
   "description": "Wrap audit-ci with a richer config model, typed JSON source of truth, and sync workflow",
   "keywords": [
@@ -36,22 +36,24 @@
     "v11y-check": "bin/v11y.js"
   },
   "files": [
+    ".meta/changelog.json",
     ".readyup/kits/*.js",
     ".readyup/manifest.json",
+    "CHANGELOG.md",
     "bin",
     "dist",
     "templates"
   ],
   "dependencies": {
-    "@williamthorsen/nmr-core": "0.10.4",
-    "@williamthorsen/toolbelt.errors": "0.6.3",
+    "@williamthorsen/nmr-core": "0.11.0",
+    "@williamthorsen/toolbelt.errors": "0.7.0",
     "audit-ci": "7.1.0",
-    "zod": "4.4.3"
+    "zod": "4.5.4"
   },
   "devDependencies": {
-    "@williamthorsen/toolbelt.filesystem": "0.8.2",
-    "@williamthorsen/toolbelt.testing": "0.5.0",
-    "@williamthorsen/toolbelt.vitest": "0.8.0",
+    "@williamthorsen/toolbelt.filesystem": "0.8.3",
+    "@williamthorsen/toolbelt.testing": "0.5.1",
+    "@williamthorsen/toolbelt.vitest": "0.9.0",
     "readyup": "0.35.0"
   },
   "engines": {