Release version 0.11.0: Introduced a comprehensive addon/plugin system with lifecycle hooks, enhanced support for package.yaml, and new CLI flags for global package scanning and cache management. Fixed transport fidelity for .npmrc and improved JSON output for machine readability. Updated documentation to reflect new features and ensured all changes are covered by tests, increasing test coverage to 598 passing tests. Updated CHANGELOG.md with detailed release notes.

Author: vcode-sh

.github/workflows/dependency-freshness.yml

@@ -0,0 +1,44 @@
+# Dependency Freshness -- because "we'll update later" is not a strategy.
+name: Dependency Freshness
+
+on:
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: '0 6 * * 1'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: depfresh-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  depfresh:
+    name: Run depfresh
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: pnpm/action-setup@v4
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 24.x
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Generate depfresh JSON report
+        run: npx --yes depfresh --output json --fail-on-outdated > depfresh-report.json
+        continue-on-error: true
+
+      - name: Upload depfresh report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: depfresh-report
+          path: depfresh-report.json

CHANGELOG.md

@@ -2,6 +2,32 @@
 
 Format based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). Semver because I'm not a psychopath.
 
+## [0.11.0] - 2026-02-23
+
+The "close every gap or shut up" release. Ran a full codebase audit against taze, found 5 gaps, closed all 5 in one pass. Verified with real code inspection, runtime test runs, and CLI smoke checks on actual repos. Not vibes. Not a roadmap. Shipped code with 598 passing tests.
+
+### Added
+
+- **Addon/plugin system** -- first-class `addons` with deterministic lifecycle ordering, async hooks, and per-package write veto. Failures surface as `AddonError` (`ERR_ADDON`) with addon name + hook metadata. Debugging no longer requires telepathy.
+- **`package.yaml` support** -- full pipeline: discovery, resolve, write. Both `package.json` and `package.yaml` load, with deterministic same-directory precedence (YAML wins). Overrides, `pnpm.overrides`, `packageManager`, protocol-preserving rewrites, CRLF/trailing-newline preservation -- all work. Workspace-boundary parity included.
+- **`--global-all`** -- scans npm + pnpm + bun global packages in one run. Dedupes by package name, maps write targets back to every matching manager. `--global` still works for single-manager mode.
+- **`--ignore-paths`** -- exclude directories from package discovery. The flag taze had that we didn't. Now we do.
+- **`--refresh-cache` / `--no-cache`** -- explicit cache bypass without overloading `--force` semantics. Fresh registry metadata, no guessing.
+
+### Fixed
+
+- **`.npmrc` transport fidelity** -- registry requests now actually use `proxy`, `https-proxy`, `strict-ssl`, and `cafile` via `undici` transport. Previously parsed, politely ignored. HTTPS prefers `https-proxy`, HTTP prefers `proxy`, CA bundles loaded once and reused.
+- **Non-transient transport failures fail fast** -- broken `cafile` paths no longer waste retry attempts. `ResolveError` immediately. You're welcome.
+- **JSON output cleaned** -- `--output json` forces silent logging. No ANSI cursor restore leaking into stdout in non-TTY. Machine-parseable means machine-parseable.
+
+### Changed
+
+- **Docs parity** -- all new flags documented in README, CLI reference, and configuration docs. No "added the flag, forgot the docs" energy.
+
+### Stats
+
+- 60 new tests (538 -> 598). 77 test files. Build, typecheck, lint clean. Verified against taze v19.9.2 (55 tests, 13 test files). The numbers speak.
+
 ## [0.10.1] - 2026-02-23
 
 The "your age column was a decoration" patch. Turns out npm's abbreviated metadata endpoint doesn't return the `time` field, so the age column was rendering headers with no data like a restaurant menu with no prices. Switched to full metadata. The cache means you pay the bandwidth once per TTL, cry about it never.
@@ -296,6 +322,7 @@ First release. Wrote it from scratch because waiting for PRs to get merged in ta
 - TTY detection. No spinners in your CI logs. `NO_COLOR` respected.
 - 54 tests. More than some production apps I've seen.
 
+[0.11.0]: https://github.com/vcode-sh/depfresh/releases/tag/v0.11.0
 [0.10.1]: https://github.com/vcode-sh/depfresh/releases/tag/v0.10.1
 [0.10.0]: https://github.com/vcode-sh/depfresh/releases/tag/v0.10.0
 [0.9.2]: https://github.com/vcode-sh/depfresh/releases/tag/v0.9.2

README.md

@@ -18,7 +18,7 @@ Spiritual successor to [taze](https://github.com/antfu/taze) by Anthony Fu -- a
 - **Per-package modes** -- `packageMode` lets you set exact, glob, or regex patterns per dependency.
 - **Write safely** -- `--write` updates files. `--verify-command` tests each dep individually and reverts failures.
 - **Post-write hooks** -- `--execute`, `--install`, `--update`. Chain commands after writing.
-- **Global packages** -- `--global` checks npm, pnpm, and bun globals.
+- **Global packages** -- `--global` checks one detected manager, `--global-all` scans npm + pnpm + bun with deduped package names.
 - **Private registries** -- full `.npmrc` support. Scoped registries, auth tokens, env vars. Fixed from day one.
 - **JSON output** -- structured envelope for scripts and AI agents. No ANSI noise.
 - **CI mode** -- `--fail-on-outdated` exits with code 1. Plug it into your pipeline.
@@ -29,13 +29,15 @@ Spiritual successor to [taze](https://github.com/antfu/taze) by Anthony Fu -- a
 - **Sorting** -- 6 strategies: by diff severity, publish time, or name.
 - **CRLF preservation** -- Windows line endings survive the write. You're welcome.
 - **Nested workspace detection** -- auto-skips monorepos inside monorepos.
-- **Programmatic API** -- 9 exported functions, 7 lifecycle callbacks, full type safety.
+- **Programmatic API** -- lifecycle callbacks + addon system for custom workflows.
 
 ## Why
 
 Because `npm outdated` gives you a table and then abandons you. Because Renovate requires a PhD in YAML. Because your AI coding assistant should be able to update your deps without you holding its hand.
 
-depfresh checks every `package.json` in your project, tells you what's outdated, and optionally writes the updates. Monorepos, workspace catalogs, private registries - it handles all of it without a config file.
+depfresh checks every package manifest (`package.json`, `package.yaml`) in your project, tells you what's outdated, and optionally writes the updates. Monorepos, workspace catalogs, private registries - it handles all of it without a config file.
+
+If both `package.yaml` and `package.json` exist in the same directory, depfresh uses `package.yaml` and skips the sibling `package.json` to avoid duplicate package entries.
 
 ## Install
 
@@ -85,6 +87,16 @@ depfresh -w --verify-command "pnpm test"
 
 # CI: fail if anything is outdated
 depfresh --fail-on-outdated
+
+# Skip specific directories from recursive scan
+depfresh --ignore-paths "apps/legacy/**,examples/**"
+
+# Bypass cache for one run (same behavior)
+depfresh --refresh-cache
+depfresh --no-cache
+
+# Check globals across npm + pnpm + bun (deduped names)
+depfresh --global-all
 ```
 
 ## CLI Flags
@@ -93,14 +105,18 @@ The top flags to get you started. Full reference with all 27+ flags: **[docs/cli
 
 | Flag | Alias | Default | Description |
 |------|-------|---------|-------------|
-| `--recursive` | `-r` | `true` | Recursively search for package.json files |
+| `--recursive` | `-r` | `true` | Recursively search for package manifests (`package.json`, `package.yaml`) |
 | `--write` | `-w` | `false` | Write updated versions to package files |
 | `--interactive` | `-I` | `false` | Select which deps to update |
 | `--mode` | `-m` | `default` | Range mode: `default` `major` `minor` `patch` `latest` `newest` `next` |
 | `--include` | `-n` | -- | Only include packages matching regex (comma-separated) |
 | `--exclude` | `-x` | -- | Exclude packages matching regex (comma-separated) |
-| `--force` | `-f` | `false` | Force update even if version is satisfied |
-| `--global` | `-g` | `false` | Check global packages |
+| `--ignore-paths` | -- | -- | Extra ignore globs (comma-separated), merged with default ignored paths |
+| `--force` | `-f` | `false` | Force update even if version is satisfied (does not bypass cache) |
+| `--refresh-cache` | -- | `false` | Bypass cache reads and fetch fresh metadata for this run |
+| `--no-cache` | -- | `false` | Alias for `--refresh-cache` |
+| `--global` | `-g` | `false` | Check global packages for one detected package manager |
+| `--global-all` | -- | `false` | Check global packages across npm, pnpm, and bun with deduped package names |
 | `--output` | `-o` | `table` | Output format: `table` `json` |
 | `--execute` | `-e` | -- | Run command after writing (e.g. `"pnpm test"`) |
 | `--verify-command` | `-V` | -- | Run command per dep, revert on failure |
@@ -126,6 +142,22 @@ export default defineConfig({
 })
 ```
 
+Addon example (programmatic API):
+
+```typescript
+import { check, resolveConfig, type depfreshAddon } from 'depfresh'
+
+const addon: depfreshAddon = {
+  name: 'audit-log',
+  afterPackageWrite(_ctx, pkg, changes) {
+    console.log(`updated ${pkg.name}: ${changes.length} changes`)
+  },
+}
+
+const options = await resolveConfig({ write: true, addons: [addon] })
+await check(options)
+```
+
 Full options reference: **[docs/configuration/](docs/configuration/)**
 
 ## JSON Output
@@ -244,7 +276,7 @@ const options = await resolveConfig({
 const exitCode = await check(options)
 ```
 
-9 exported functions, 7 lifecycle callbacks, 16+ types. Full API reference: **[docs/api/](docs/api/)**
+Programmatic API with lifecycle callbacks, addon plugins, and full typed exports. Full reference: **[docs/api/](docs/api/)**
 
 ## Monorepo Support
 
@@ -253,11 +285,11 @@ depfresh auto-detects workspace structures. No config needed.
 | Package Manager | Workspaces | Catalogs |
 |----------------|------------|----------|
 | pnpm | `pnpm-workspace.yaml` | `catalog:` protocol |
-| Bun | `workspaces` in `package.json` | `workspaces.catalog` |
-| Yarn | `workspaces` in `package.json` | `.yarnrc.yml` catalogs |
-| npm | `workspaces` in `package.json` | -- |
+| Bun | `workspaces` in `package.json` or `package.yaml` | `workspaces.catalog` |
+| Yarn | `workspaces` in `package.json` or `package.yaml` | `.yarnrc.yml` catalogs |
+| npm | `workspaces` in `package.json` or `package.yaml` | -- |
 
-Workspace catalogs are resolved and updated in-place. Your `pnpm-workspace.yaml` catalog entries get depfreshaded alongside your `package.json` deps. No manual sync needed.
+Workspace catalogs are resolved and updated in-place. Your `pnpm-workspace.yaml` catalog entries get depfreshaded alongside your manifest deps (`package.json` / `package.yaml`). No manual sync needed.
 
 ## Private Registries
 
@@ -271,30 +303,67 @@ depfresh reads `.npmrc` from your project and home directory. Scoped registries,
 
 This was broken in taze for 4+ years. I fixed it on day one. You're welcome.
 
-## What I Fixed from taze
-
-Not to throw shade at taze -- it served the community well for years. But some things needed fixing, and "PR welcome" only goes so far when the PRs sit open for months.
-
-| Problem | taze | depfresh |
-|---------|------|------|
-| `.npmrc` / private registries | Ignored | Full support |
-| Network retry | None | Exponential backoff |
-| Write clobber (bun catalogs) | Data loss | Single-writer architecture |
-| Version resolution ordering | Assumed sorted arrays | Explicit semver comparison |
-| Interactive mode | Flickery | @clack/prompts |
-| JSON output | None | Structured envelope |
-| Dep type filtering | None | `--deps-only` / `--dev-only` |
-| Config merging | deepmerge (CJS) | defu (ESM) |
-| npm config loading | @npmcli/config (heavy, hacky) | Direct ini parsing |
-| Cache | JSON file (race conditions) | SQLite with WAL mode |
+## depfresh vs taze
+
+Verified against taze v19.9.2 (commit `31c6fe8`, 2026-01-20). Not marketing. Real code inspection, runtime test runs, CLI smoke checks on actual repos.
+
+### Feature parity (both have it)
+
+| Feature | taze | depfresh | Notes |
+|---------|------|----------|-------|
+| 7 range modes | yes | yes | |
+| Include/exclude filters | yes | yes | depfresh adds glob patterns alongside regex |
+| Interactive TUI | yes | yes | Both have vim keys + per-version selection |
+| `--cwd` | yes | yes | |
+| `--fail-on-outdated` | yes | yes | |
+| `package.yaml` support | yes | yes | |
+| Addon/plugin API | yes | yes | |
+| pnpm catalogs | yes | yes | |
+| Yarn catalogs | yes | yes | |
+| CRLF preservation | yes | yes | |
+| CJK width handling | yes | yes | |
+
+### Where depfresh is ahead
+
+| Feature | taze | depfresh |
+|---------|------|----------|
+| JSON output envelope | no ([#201](https://github.com/antfu-collective/taze/issues/201) open) | Structured envelope with schema version |
+| Machine-readable CLI contract | no | `--help-json` with workflows, flag relationships, schema |
+| `--deps-only` / `--dev-only` | no ([#101](https://github.com/antfu-collective/taze/issues/101) open) | yes |
+| `packageMode` precedence | buggy ([#91](https://github.com/antfu-collective/taze/issues/91) open) | Deterministic |
+| Global package breadth | npm + pnpm | npm + pnpm + bun (`--global-all`) |
+| Bun catalog writes | Bug history, data loss risk | Single-writer architecture, tested |
+| `.npmrc` / private registries | Ignored for years | Full support from day one |
+| `.npmrc` transport (proxy/TLS/CA) | Parsed, not applied | Applied via `undici` transport adapter |
+| Network retry | None | Exponential backoff, non-transient errors fail fast |
+| Cache | JSON file (race conditions) | SQLite WAL mode, memory fallback |
+| Verify + rollback | no | `--verify-command` tests each dep, reverts failures |
+| Typed error hierarchy | Limited | Structured subclasses with `.code` and `.cause` |
+| Structured JSON errors | no | JSON error envelope with `error.code`, `error.retryable` |
+| Explicit cache bypass | no | `--refresh-cache` / `--no-cache` |
+
+### Where taze is ahead
+
+| Area | Why |
+|------|-----|
+| Ecosystem adoption | 4,061 stars, years of trust, larger user base |
+| npm config edge cases | `@npmcli/config` may cover obscure auth patterns we haven't hit yet |
+
+### Numbers
+
+| Metric | taze v19.9.2 | depfresh v0.11.0 |
+|--------|-------------:|------------------:|
+| Test files | 13 | 77 |
+| Passing tests | 55 | 598 |
+| CLI flags | 24 | 36 |
 
 ## Documentation
 
 The full docs, for people who read manuals before assembling furniture.
 
 - **[CLI Reference](docs/cli/)** -- all 27+ flags, modes, sorting, filtering, hooks, interactive, CI, workspaces
 - **[Configuration](docs/configuration/)** -- config files, every option, packageMode, depFields, private registries, cache
-- **[Programmatic API](docs/api/)** -- exported functions, lifecycle callbacks, types, workflow examples
+- **[Programmatic API](docs/api/)** -- exported functions, lifecycle callbacks, addon plugins, types, workflow examples
 - **[Output Formats](docs/output-formats/)** -- table, JSON, exit codes, AI agent integration
 - **[Agent Workflows](docs/agents/README.md)** -- copy-paste quickstarts for Codex, Claude Code, and Gemini CLI
 - **[Integrations](docs/integrations/README.md)** -- GitHub Actions and thin MCP wrapper guidance

docs/README.md

@@ -16,7 +16,7 @@ Everything I know about depfresh is in here, split into files so you can pretend
   - [Options Reference](./configuration/options.md) -- the exhaustive list
   - [Workspaces](./configuration/workspaces.md) -- monorepos, catalogs, scanning
 
-- **[Programmatic API](./api/)** -- Exported functions, lifecycle callbacks, types, and workflow examples. For when you want to wrap depfresh in your own tooling and take credit for it. I respect the hustle.
+- **[Programmatic API](./api/)** -- Exported functions, lifecycle callbacks, addon plugins, types, and workflow examples. For when you want to wrap depfresh in your own tooling and take credit for it. I respect the hustle.
   - [Overview](./api/overview.md) -- quick start, defaults, examples
   - [Functions](./api/functions.md) -- every exported function
   - [Types](./api/types.md) -- the type catalogue

docs/api/README.md

@@ -6,8 +6,8 @@ I exposed the internals. On purpose. You can `import` from `depfresh` and do wha
 
 - **[Overview](./overview.md)** -- Quick start, defaults, workflow examples. The "just show me some code" page.
 
-- **[Functions](./functions.md)** -- Every exported function: `check`, `resolveConfig`, `loadPackages`, `resolvePackage`, `writePackage`, and the rest. Plus lifecycle callbacks for the control freaks.
+- **[Functions](./functions.md)** -- Every exported function: `check`, `resolveConfig`, `loadPackages`, `resolvePackage`, `writePackage`, and the rest. Includes lifecycle callbacks and addon plugin hooks.
 
-- **[Types](./types.md)** -- The full type catalogue. `depfreshOptions`, `PackageMeta`, `ResolvedDepChange`, and 15 other things your editor wants to autocomplete.
+- **[Types](./types.md)** -- The full type catalogue. `depfreshOptions`, `depfreshAddon`, `PackageMeta`, `ResolvedDepChange`, and everything your editor wants to autocomplete.
 
-- **[Errors](./errors.md)** -- Structured error classes: `RegistryError`, `CacheError`, `ConfigError`, `WriteError`, `ResolveError`. All extend `depfreshError`, all have stable codes.
+- **[Errors](./errors.md)** -- Structured error classes: `RegistryError`, `CacheError`, `ConfigError`, `WriteError`, `ResolveError`, `AddonError`. All extend `depfreshError`, all have stable codes.

docs/api/errors.md

@@ -5,6 +5,7 @@ All errors thrown by depfresh extend `depfreshError`, which gives you a stable `
 ```ts
 import {
   depfreshError,
+  AddonError,
   RegistryError,
   CacheError,
   ConfigError,
@@ -20,6 +21,7 @@ import {
 | `depfreshError` | (base) | Abstract base. Use `instanceof depfreshError` to catch everything depfresh throws. |
 | `RegistryError` | `ERR_REGISTRY` | HTTP errors from the npm/JSR registry. Has `.status` (number) and `.url` (string). 4xx errors don't retry. 5xx errors do. |
 | `CacheError` | `ERR_CACHE` | SQLite failures, corrupt entries, connection issues. depfresh logs and falls back to memory cache -- you'll only see this if you're using the cache API directly. |
+| `AddonError` | `ERR_ADDON` | Addon hook failures. Includes `.addon` and `.hook` to identify the failing plugin and lifecycle stage. |
 | `ConfigError` | `ERR_CONFIG` | Invalid config file, malformed regex patterns in `include`/`exclude`, bad `packageMode` entries. Thrown during `resolveConfig()` or `parseDependencies()`. |
 | `WriteError` | `ERR_WRITE` | File system failures during package writes. Permission denied, disk full, the usual suspects. |
 | `ResolveError` | `ERR_RESOLVE` | Network timeouts, DNS failures, fetch errors that aren't HTTP status codes. The "something went wrong between you and the registry" bucket. |