Version Packages

packages/cli/CHANGELOG.md

@@ -1,5 +1,35 @@
 # svelte-vitals
 
+## 0.44.1
+
+### Patch Changes
+
+- a9fba45: Fix `--baseline` silently masking a genuine regression: for the SEO rules whose passing results already carry a file `location` (`seo/title-presence` and the ten `headTagRule`-backed ids — `canonical-url`, `og-title`, `og-image`, `charset`, `viewport`, `twitter-card`, `description-presence`, `og-description`, `json-ld`, `og-url`), a route that passed at the baseline ref and then regressed (e.g. a `<title>` deleted) produced identical comparison keys on both sides and was dropped as "not new" instead of being reported. `findingKey` comparison is now penalized-findings-only on both the current and baseline sides (matching the pattern `suppressions.ts` already uses), so a passing result can never key-collide with a penalized one.
+
+  Behavior change as a result: passing results no longer appear in `--baseline` output at all — previously, a route that was penalized at the baseline and now passes could still surface its passing result. Under `--baseline --score`, Health is now computed over the new penalized findings only — pass-seeded routes and categories no longer raise it — so a `--baseline` run's Health/`--min-health` can report a lower (stricter) score than before. See `docs/superpowers/specs/2026-08-08-pass-result-location-design.md` ("`findingKey` / `filterToNewFindings`" section) for the design record.
+
+- ac41349: Fix `files:`-scoped `severity: 'off'` overrides silently failing to remove a passing seed (issue #382), now that `@svelte-vitals/core` gives every rule's PASS result the same `location` its penalized counterpart would (see the linked design doc). Without a matching CLI-side fix, that alone would have broken `--diff`/`--staged`: `filterToChangedFiles` used to keep a result whenever it had _any_ `location` in the changed set, so once passing results uniformly carried one, an incidental pass on a changed file could survive scoping.
+
+  `filterToChangedFiles` (and its one call site, `applyScope`) now takes the resolved `Config` (optional, defaulting like `filterToNewFindings` in `baseline.ts` already does) and keeps a result only when it's penalized, or is `architecture/unit-entry-file`'s deliberately route-less pass seed (PR #337) — every other route-carrying PASS is dropped even when its `location` is in the changed set.
+
+  Behavior change as a result: for `seo/title-presence` and the ten `headTagRule`-backed rule ids (`canonical-url`, `og-title`, `og-image`, `charset`, `viewport`, `twitter-card`, `description-presence`, `og-description`, `json-ld`, `og-url`) — which already carried `location` on PASS before this change — a passing result on a changed file no longer survives `--diff`/`--staged` filtering. This was a live, undetected leak: a single incidental passing check on a changed file could promote its whole category from _absent_ to a fabricated 100, pulling `--diff` Health upward. Measured on the reference shape (one critical `correctness` finding plus one such SEO PASS, both on changed files, default config): Health moves from **89 to 79** — 79 is correct; 89 was the bug. A `--min-health` gate can now fail a run that previously passed only because of this leak. The three rules named in the design doc (`seo/title-length`, `seo/description-length`, `performance/preconnect`) newly gain `location` in this release too, but their PASS results are penalized-gated the same way, so they contribute no net `--diff` Health movement of their own — their `location` addition only matters for the `files:`-override fix above.
+
+  `architecture/unit-entry-file`'s route-less pass seed is exempt from the drop above (PR #337) — this preserves pre-existing behavior, not a new exception: `main`'s `filterToChangedFiles` already kept this pass unconditionally (no `isPenalized` gate at all), so a changed conforming unit already promoted `architecture` to a fabricated 100 in `--diff` Health before this release, and still does after — the tradeoff (that pass staying visible under `--diff`, at that cost) is #337's, kept as-is, not something this PR introduces or removes.
+
+  See `docs/superpowers/specs/2026-08-08-pass-result-location-design.md` for the full design record. The `svelte-vitals-action` repo bundles `applyScope`, so its `--diff` Health inherits this change on its next dependency bump — its own release notes should carry the same warning.
+
+- bd946e2: Let `--out-file -` (space-separated) and `--out-file=-` stream to stdout again, matching the documented contract (`--help`, the reporters guide, and `svelte-vitals docs show output`). The flag-shaped/empty-value guard added in the previous release rejected the literal `-` along with every other dash-prefixed value; `-` is now the one allowed exception, exempted only for `--out-file`. Regular file paths (e.g. `--out-file report.html`) were never affected and remain valid; dash-prefixed values for every other flag — and any dash-prefixed `--out-file` value other than exactly `-` — still exit 2 as before.
+- 7c5a11b: Exit 2 when `--rules` and `--category` are both passed and `--category` excludes every rule named in `--rules`. Previously `analyzeProject`'s category filter ran after rule selection, so a `--rules` id whose category wasn't in `--category` was dropped silently — the run exited 0 with zero rules examined and nothing on stderr (issue #384). The check mirrors the existing unknown-rule-id error: fatal, naming the excluded rule id(s) and the `--category` list. `--ignore` is unaffected — ignoring a rule that `--category` already excludes is harmless, not a conflict.
+- f0798b0: Update the registry-visible package descriptions and keywords, which still described svelte-vitals as an SEO-only checker. `svelte-vitals`'s description now matches its own `--help` text — a deterministic SvelteKit code-health scanner across SEO, performance, correctness, security, and architecture — and adds `performance`, `security`, `code-quality`, `static-analysis` keywords. `@svelte-vitals/vite`'s description now also mentions the live dev dashboard alongside the build-time prerendered-HTML analysis. No behavior change.
+- ab41e48: Scoped runs (`--diff`/`--staged`/`--baseline`) no longer report `svelte-vitals-suppressions.json` entries as stale just because the scope excluded their findings — staleness is now judged against the project-wide result set, so the documented CI recipe (`--diff origin/main --baseline origin/main`) no longer prints a misleading "N stale entries — re-run --update-suppressions to prune" on every run. `--route` runs, where even the project-wide set is collected route-narrowed, omit the stale count entirely rather than report an unreliable one. `--update-suppressions` combined with `--route` now refuses (exit 2) instead of silently pruning suppression entries outside that route.
+- 28d22ae: Naming a rule in `--rules` that a config `overrides` entry scopes `'off'` (directly by rule id, or via its category key) now prints a startup warning naming the rule and the overrides entry's `files`/`route` scope, instead of silently reporting a compliant tree. The semantics — whether `--rules` should force-enable through a scoped `'off'` — are deliberately unchanged; only the silence is fixed (#385).
+- Updated dependencies [a3dffb3]
+- Updated dependencies [8e8bd5c]
+- Updated dependencies [ac41349]
+- Updated dependencies [65ce0c1]
+- Updated dependencies [acee3c6]
+  - @svelte-vitals/core@0.39.0
+
 ## 0.44.0
 
 ### Minor Changes

packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "svelte-vitals",
-  "version": "0.44.0",
+  "version": "0.44.1",
   "description": "A deterministic SvelteKit code-health scanner (SEO, performance, correctness, security, architecture) — not a runtime Web Vitals reporter.",
   "type": "module",
   "license": "MIT",