Flog changelog

Unreleased#

The installer, self-updater, and website Release adapters now discover and validate canonical Repopack version-2 Release API URLs pinned to the canonical project key, numeric channel, rolling Job, exact version or Run, artifact size, and SHA-256. Existing Flog-facing manifest formats remain compatible.
The installer now updates independent existing .bashrc and .bash_profile files so both Bash login and non-login shells receive the default PATH setup.

flog upgrade now avoids keeping older framework copies when upgraded versions satisfy their dependencies. It retains older versions when a package actually requires them.

Added flog deprecate for previewing, setting, and clearing npm-compatible deprecation messages on one exact published package version, with stable JSON outcomes, conflict and authentication safety, ambiguous cancellation handling, and post-write verification.

flog upgrade now reuses a newly selected direct version for compatible transitive edges, avoiding unnecessary duplicate package versions while preserving incompatible ranges, overrides, and distinct peer contexts.
Removed --no-install from flog add, flog remove, and flog upgrade. Applied dependency changes now always install the resulting graph; use upgrade --dry-run for read-only planning.

Added a release-only RSS feed at /changelog.rss derived from the canonical changelog; unreleased entries are excluded.

Added read-only flog audit checks of exact versions in the committed lock graph through npm-compatible Bulk Advisory endpoints. Use --prod to omit development-only roots; complete checks exit 4 for any finding, while incomplete checks fail closed with exit 1.
flog lock and flog add now check advisories before writing. Newly affected exact package versions block, retained findings warn, and --force accepts complete known findings; incomplete checks always fail closed and cannot be bypassed.
Dependency lifecycle approvals in the root allowScripts map now require exact locked identities such as "esbuild@0.28.2": true. Name-only approvals are rejected; review and replace them with exact versions before installing.

Root package.json overrides now control transitive dependency resolution.
Added bounded flog format for explicitly selected JavaScript and TypeScript files. Standalone .js files use ESM syntax without needing package.json; unsupported or ambiguous syntax is refused instead of rewritten. Later changes added safe JSDoc ownership and bounded untagged template literals.