since-dev 0.1.0__tar.gz → 0.1.2__tar.gz

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (17) hide show
  1. {since_dev-0.1.0/since_dev.egg-info → since_dev-0.1.2}/PKG-INFO +17 -7
  2. {since_dev-0.1.0 → since_dev-0.1.2}/README.md +16 -6
  3. {since_dev-0.1.0 → since_dev-0.1.2}/pyproject.toml +1 -1
  4. {since_dev-0.1.0 → since_dev-0.1.2}/since_dev/__init__.py +1 -1
  5. {since_dev-0.1.0 → since_dev-0.1.2}/since_dev/cli.py +2 -1
  6. {since_dev-0.1.0 → since_dev-0.1.2}/since_dev/render.py +29 -4
  7. {since_dev-0.1.0 → since_dev-0.1.2/since_dev.egg-info}/PKG-INFO +17 -7
  8. {since_dev-0.1.0 → since_dev-0.1.2}/LICENSE +0 -0
  9. {since_dev-0.1.0 → since_dev-0.1.2}/setup.cfg +0 -0
  10. {since_dev-0.1.0 → since_dev-0.1.2}/since_dev/__main__.py +0 -0
  11. {since_dev-0.1.0 → since_dev-0.1.2}/since_dev/init.py +0 -0
  12. {since_dev-0.1.0 → since_dev-0.1.2}/since_dev/local.py +0 -0
  13. {since_dev-0.1.0 → since_dev-0.1.2}/since_dev/realio.py +0 -0
  14. {since_dev-0.1.0 → since_dev-0.1.2}/since_dev.egg-info/SOURCES.txt +0 -0
  15. {since_dev-0.1.0 → since_dev-0.1.2}/since_dev.egg-info/dependency_links.txt +0 -0
  16. {since_dev-0.1.0 → since_dev-0.1.2}/since_dev.egg-info/entry_points.txt +0 -0
  17. {since_dev-0.1.0 → since_dev-0.1.2}/since_dev.egg-info/top_level.txt +0 -0
{since_dev-0.1.0/since_dev.egg-info → since_dev-0.1.2}/PKG-INFO RENAMED
@@ -1,6 +1,6 @@
1
1
  Metadata-Version: 2.4
2
2
  Name: since-dev
3
- Version: 0.1.0
3
+ Version: 0.1.2
4
4
  Summary: Find the code in a repository that is about to stop working: retired model IDs, runtimes past end of life, breaking dependency changes. Each with its date, its line and its replacement.
5
5
  Author-email: Nabil A <support@since.dev>
6
6
  License: MIT
@@ -30,12 +30,12 @@ npx since-dev
30
30
  Run it inside any repository. A public GitHub repository needs no sign-in and no setup.
31
31
 
32
32
  ```
33
- acme/shop main@4f2c1d9 scanned just now
34
- 3 with a date 1 undated 214 dependencies and 96 files read
33
+ since-dev-lab/demo-shop main@fd7aa13 scanned just now
34
+ 3 with a date 1 undated 2 to review 4 dependencies and 7 files read
35
35
  Read from GitHub (main), not your working tree.
36
36
 
37
37
  20 days claude-sonnet-4-5-20250929 on Claude API: retirement 2026-11-30
38
- src/ai/client.ts:14 and 3 more use claude-sonnet-5-5
38
+ src/ai/client.ts:6 and 1 more use claude-sonnet-5-5
39
39
  https://platform.claude.com/docs/en/about-claude/model-deprecations
40
40
 
41
41
  31 days gpt-5 on OpenAI API: retirement 2026-12-11
@@ -46,11 +46,21 @@ Run it inside any repository. A public GitHub repository needs no sign-in and no
46
46
  .github/workflows/ci.yml use 24
47
47
  https://endoflife.date/nodejs
48
48
 
49
- Full report https://since.dev/scan/acme/shop?utm_source=cli
49
+ medium GHSA-qw6h-vgh9-j6wx: express vulnerable to XSS via response.redirect()
50
+ src/server.ts:1 use 4.20.0
51
+ https://osv.dev/vulnerability/GHSA-qw6h-vgh9-j6wx
52
+
53
+ review openai: 27 changes in newer releases may reach this code
54
+ src/ai/summarize.ts:7
55
+
56
+ review @anthropic-ai/sdk: 6 changes in newer releases may reach this code
57
+ src/ai/client.ts:9 and 1 more
58
+
59
+ Full report https://since.dev/scan/since-dev-lab/demo-shop?utm_source=cli
50
60
  Next npx since-dev init your coding agent checks before it writes
51
61
  ```
52
62
 
53
- (An example for a made-up repository. The dates are the real ones as of November 10, 2026.)
63
+ That is the output for [a small demo repository](https://github.com/since-dev-lab/demo-shop) on November 10, 2026. To see it yourself: `npx since-dev since-dev-lab/demo-shop`.
54
64
 
55
65
  ## Run it
56
66
 
@@ -76,7 +86,7 @@ To keep it, `npm install -g since-dev` or `pip install since-dev` gives you the
76
86
 
77
87
  `--all` shows every finding (10 by default), `--json` prints the answer as JSON, `--within 30d` keeps only dates within that many days.
78
88
 
79
- Findings are listed with the next deadline first, then dates that have passed, then security advisories with no date, then the ones marked `review`: Since found the name in your code but could not prove the change reaches it.
89
+ Findings are listed with the next deadline first, then dates that have passed, then security advisories with no date, then the ones marked `review`: Since found the name in your code but could not prove the change reaches it. When a dependency has many of those at one line, they print as one row with the count.
80
90
 
81
91
  ## Set up your coding agent
82
92
 
{since_dev-0.1.0 → since_dev-0.1.2}/README.md RENAMED
@@ -9,12 +9,12 @@ npx since-dev
9
9
  Run it inside any repository. A public GitHub repository needs no sign-in and no setup.
10
10
 
11
11
  ```
12
- acme/shop main@4f2c1d9 scanned just now
13
- 3 with a date 1 undated 214 dependencies and 96 files read
12
+ since-dev-lab/demo-shop main@fd7aa13 scanned just now
13
+ 3 with a date 1 undated 2 to review 4 dependencies and 7 files read
14
14
  Read from GitHub (main), not your working tree.
15
15
 
16
16
  20 days claude-sonnet-4-5-20250929 on Claude API: retirement 2026-11-30
17
- src/ai/client.ts:14 and 3 more use claude-sonnet-5-5
17
+ src/ai/client.ts:6 and 1 more use claude-sonnet-5-5
18
18
  https://platform.claude.com/docs/en/about-claude/model-deprecations
19
19
 
20
20
  31 days gpt-5 on OpenAI API: retirement 2026-12-11
@@ -25,11 +25,21 @@ Run it inside any repository. A public GitHub repository needs no sign-in and no
25
25
  .github/workflows/ci.yml use 24
26
26
  https://endoflife.date/nodejs
27
27
 
28
- Full report https://since.dev/scan/acme/shop?utm_source=cli
28
+ medium GHSA-qw6h-vgh9-j6wx: express vulnerable to XSS via response.redirect()
29
+ src/server.ts:1 use 4.20.0
30
+ https://osv.dev/vulnerability/GHSA-qw6h-vgh9-j6wx
31
+
32
+ review openai: 27 changes in newer releases may reach this code
33
+ src/ai/summarize.ts:7
34
+
35
+ review @anthropic-ai/sdk: 6 changes in newer releases may reach this code
36
+ src/ai/client.ts:9 and 1 more
37
+
38
+ Full report https://since.dev/scan/since-dev-lab/demo-shop?utm_source=cli
29
39
  Next npx since-dev init your coding agent checks before it writes
30
40
  ```
31
41
 
32
- (An example for a made-up repository. The dates are the real ones as of November 10, 2026.)
42
+ That is the output for [a small demo repository](https://github.com/since-dev-lab/demo-shop) on November 10, 2026. To see it yourself: `npx since-dev since-dev-lab/demo-shop`.
33
43
 
34
44
  ## Run it
35
45
 
@@ -55,7 +65,7 @@ To keep it, `npm install -g since-dev` or `pip install since-dev` gives you the
55
65
 
56
66
  `--all` shows every finding (10 by default), `--json` prints the answer as JSON, `--within 30d` keeps only dates within that many days.
57
67
 
58
- Findings are listed with the next deadline first, then dates that have passed, then security advisories with no date, then the ones marked `review`: Since found the name in your code but could not prove the change reaches it.
68
+ Findings are listed with the next deadline first, then dates that have passed, then security advisories with no date, then the ones marked `review`: Since found the name in your code but could not prove the change reaches it. When a dependency has many of those at one line, they print as one row with the count.
59
69
 
60
70
  ## Set up your coding agent
61
71
 
{since_dev-0.1.0 → since_dev-0.1.2}/pyproject.toml RENAMED
@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
4
4
 
5
5
  [project]
6
6
  name = "since-dev"
7
- version = "0.1.0"
7
+ version = "0.1.2"
8
8
  description = "Find the code in a repository that is about to stop working: retired model IDs, runtimes past end of life, breaking dependency changes. Each with its date, its line and its replacement."
9
9
  readme = "README.md"
10
10
  requires-python = ">=3.9"
{since_dev-0.1.0 → since_dev-0.1.2}/since_dev/__init__.py RENAMED
@@ -1,3 +1,3 @@
1
1
  """since-dev: what in a repository is about to stop working. The same CLI as the npm package of the same name."""
2
2
 
3
- __version__ = "0.1.0"
3
+ __version__ = "0.1.2"
{since_dev-0.1.0 → since_dev-0.1.2}/since_dev/cli.py RENAMED
@@ -425,7 +425,8 @@ def repo_command(ctx):
425
425
 
426
426
  full_name = "%s/%s" % (repo["owner"], repo["name"])
427
427
  # A first scan takes up to a minute, and a silent terminal reads as a hung one.
428
- io.err("Reading %s on GitHub. A first scan can take a minute.\n" % full_name)
428
+ # Run inside a repository, the name comes from its origin remote: say so, or the name looks like part of the command.
429
+ io.err("Reading %s on GitHub. A first scan can take a minute.\n" % ("this folder's repository (%s)" % full_name if from_tree else full_name))
429
430
  scan = public_scan(ctx, full_name)
430
431
  if "result" in scan:
431
432
  return report(ctx, {"kind": "scan", "result": scan["result"], "fromTree": from_tree})
{since_dev-0.1.0 → since_dev-0.1.2}/since_dev/render.py RENAMED
@@ -76,15 +76,22 @@ def _join(parts, separator):
76
76
 
77
77
 
78
78
  def scan_items(findings):
79
- """A public scan's findings, as the rows the CLI prints."""
80
- items = []
79
+ """A public scan's findings, as the rows the CLI prints.
80
+
81
+ A dependency that is a few majors behind can have dozens of changes Since could not prove reach the code, all at
82
+ the one line that imports it: those become one row.
83
+ """
84
+ rows = []
85
+ groups = {}
81
86
  for finding in findings:
82
87
  where = finding.get("where")
83
88
  where = [place for place in where if isinstance(place, dict) and place.get("path")] if isinstance(where, list) else []
84
89
  source = finding.get("source")
85
90
  source = source.get("url") if isinstance(source, dict) else None
91
+ surface = finding["surface"] if isinstance(finding.get("surface"), dict) else {}
92
+ name = str(surface.get("name") or "")
86
93
  title = finding.get("title")
87
- items.append({
94
+ row = {
88
95
  "title": "" if title is None else str(title),
89
96
  "review": finding.get("state") == "needs_review",
90
97
  "severity": finding.get("severity"),
@@ -93,7 +100,25 @@ def scan_items(findings):
93
100
  "extra": max(0, len(where) - 1) + (finding["more"] if is_number(finding.get("more")) else 0),
94
101
  "replacement": finding.get("replacement") or None,
95
102
  "source": source or None,
96
- })
103
+ "hint": None,
104
+ }
105
+ if not row["review"] or row["daysLeft"] is not None or not name:
106
+ rows.append(row)
107
+ continue
108
+ key = "%s|%s" % (surface.get("key") or name, row["place"] or "")
109
+ if key in groups:
110
+ groups[key]["members"].append(row)
111
+ else:
112
+ groups[key] = {"members": [row], "name": name}
113
+ rows.append(groups[key])
114
+ items = []
115
+ for row in rows:
116
+ if "members" not in row:
117
+ items.append(row)
118
+ elif len(row["members"]) == 1:
119
+ items.append(row["members"][0])
120
+ else:
121
+ items.append(dict(row["members"][0], title="%s: %s changes in newer releases may reach this code" % (row["name"], num(len(row["members"]))), replacement=None, source=None))
97
122
  return items
98
123
 
99
124
 
{since_dev-0.1.0 → since_dev-0.1.2/since_dev.egg-info}/PKG-INFO RENAMED
@@ -1,6 +1,6 @@
1
1
  Metadata-Version: 2.4
2
2
  Name: since-dev
3
- Version: 0.1.0
3
+ Version: 0.1.2
4
4
  Summary: Find the code in a repository that is about to stop working: retired model IDs, runtimes past end of life, breaking dependency changes. Each with its date, its line and its replacement.
5
5
  Author-email: Nabil A <support@since.dev>
6
6
  License: MIT
@@ -30,12 +30,12 @@ npx since-dev
30
30
  Run it inside any repository. A public GitHub repository needs no sign-in and no setup.
31
31
 
32
32
  ```
33
- acme/shop main@4f2c1d9 scanned just now
34
- 3 with a date 1 undated 214 dependencies and 96 files read
33
+ since-dev-lab/demo-shop main@fd7aa13 scanned just now
34
+ 3 with a date 1 undated 2 to review 4 dependencies and 7 files read
35
35
  Read from GitHub (main), not your working tree.
36
36
 
37
37
  20 days claude-sonnet-4-5-20250929 on Claude API: retirement 2026-11-30
38
- src/ai/client.ts:14 and 3 more use claude-sonnet-5-5
38
+ src/ai/client.ts:6 and 1 more use claude-sonnet-5-5
39
39
  https://platform.claude.com/docs/en/about-claude/model-deprecations
40
40
 
41
41
  31 days gpt-5 on OpenAI API: retirement 2026-12-11
@@ -46,11 +46,21 @@ Run it inside any repository. A public GitHub repository needs no sign-in and no
46
46
  .github/workflows/ci.yml use 24
47
47
  https://endoflife.date/nodejs
48
48
 
49
- Full report https://since.dev/scan/acme/shop?utm_source=cli
49
+ medium GHSA-qw6h-vgh9-j6wx: express vulnerable to XSS via response.redirect()
50
+ src/server.ts:1 use 4.20.0
51
+ https://osv.dev/vulnerability/GHSA-qw6h-vgh9-j6wx
52
+
53
+ review openai: 27 changes in newer releases may reach this code
54
+ src/ai/summarize.ts:7
55
+
56
+ review @anthropic-ai/sdk: 6 changes in newer releases may reach this code
57
+ src/ai/client.ts:9 and 1 more
58
+
59
+ Full report https://since.dev/scan/since-dev-lab/demo-shop?utm_source=cli
50
60
  Next npx since-dev init your coding agent checks before it writes
51
61
  ```
52
62
 
53
- (An example for a made-up repository. The dates are the real ones as of November 10, 2026.)
63
+ That is the output for [a small demo repository](https://github.com/since-dev-lab/demo-shop) on November 10, 2026. To see it yourself: `npx since-dev since-dev-lab/demo-shop`.
54
64
 
55
65
  ## Run it
56
66
 
@@ -76,7 +86,7 @@ To keep it, `npm install -g since-dev` or `pip install since-dev` gives you the
76
86
 
77
87
  `--all` shows every finding (10 by default), `--json` prints the answer as JSON, `--within 30d` keeps only dates within that many days.
78
88
 
79
- Findings are listed with the next deadline first, then dates that have passed, then security advisories with no date, then the ones marked `review`: Since found the name in your code but could not prove the change reaches it.
89
+ Findings are listed with the next deadline first, then dates that have passed, then security advisories with no date, then the ones marked `review`: Since found the name in your code but could not prove the change reaches it. When a dependency has many of those at one line, they print as one row with the count.
80
90
 
81
91
  ## Set up your coding agent
82
92
 
{since_dev-0.1.0 → since_dev-0.1.2}/LICENSE RENAMED
File without changes
{since_dev-0.1.0 → since_dev-0.1.2}/setup.cfg RENAMED
File without changes
{since_dev-0.1.0 → since_dev-0.1.2}/since_dev/init.py RENAMED
File without changes
{since_dev-0.1.0 → since_dev-0.1.2}/since_dev/local.py RENAMED
File without changes
{since_dev-0.1.0 → since_dev-0.1.2}/since_dev/realio.py RENAMED
File without changes