Changelog

Latest updates and feature releases for xtarterize.

v1.18.0 — 2026-07-06

New mergeYaml / parseYaml functions in @xtarterize/patchers for deep-merging configuration into YAML files. Existing keys are preserved, incoming keys fill gaps. Works with GitHub Actions workflows, Renovate configs, and any YAML-based config file.
Plugin specifier validation (ADR 026): Plugin specifiers in .xtarterizerc and package.json xtarterize.plugins are now validated as npm package names. Relative paths (../../malicious.js), absolute paths (/etc/passwd), and URL specifiers are rejected — preventing arbitrary code execution from attacker-controlled paths.
installDependency now throws an error when installation fails, instead of silently logging a warning and continuing.
Backup source path traversal protection: restored files from xtarterize undo are now validated to resolve within the backup directory.

v1.17.0 — 2026-07-01

The .xtarterize/ directory (backups, cache) is now automatically added to .gitignore when running any xtarterize command. No more untracked files in git status. (ADR 026)

v1.16.0 - June 29, 2026

Natural language task query

New xtarterize query <query> command that discovers tasks using a pure-algorithmic scoring engine (no AI). Five weighted signals (label, id, group, keywords, config) with Levenshtein fuzzy matching, domain-specific synonym expansion, and coverage-based ranking.

Results are grouped by domain bundle (e.g. TypeScript, CI/CD) with per-group actionable xtarterize add commands.

New xtarterize init --compose <query> flag that reorders init tasks by relevance.

Task metadata enrichment

New optional searchMeta field on the Task interface (tags, configTargets, keywords) enables richer search. All 26 built-in tasks include search metadata.

v1.15.2 - June 29, 2026

Monorepo-aware task filtering

Running xtarterize in a monorepo now shows only relevant tasks for where you’re running from:

Running from the monorepo root? You’ll see CI/CD, release tooling, turbo, renovate, and editor config tasks - not package-level tsconfig or Vite plugin tasks.
Running inside a workspace package? You’ll see tsconfig path aliases, vite-plugin-checker, and rollup-plugin-visualizer - not root-level CI or release tasks.
Tasks that apply everywhere continue to work as before.

Also fixes a detection bug where Node.js projects using Vite for build orchestration were misidentified as runtime: 'browser' instead of runtime: 'node'.

Concurrency and CI resilience

Running xtarterize concurrently across multiple workspace packages no longer crashes with spurious file-not-found errors thanks to cache collision protection. Tests are also now more resilient to transient failures and version drift in external tools.

v1.15.0 - June 29, 2026

Restore, add, and doctor flags

New flags across the restoration, add, and diagnostic commands: restore --yes skips confirmation when restoring the latest backup, while restore --quiet suppresses verbose output. add --all applies all new and patch tasks without interaction, and doctor --json is now visible in command-level --help.

create-xtarter-app scaffolding enhancements

create-xtarter-app gains several new flags: --quiet suppresses banners and progress output, --json outputs the scaffold result as structured JSON, and --no-color disables colorized output. The --yes flag now defaults to the next-chakra template when -t is omitted. The help system has been migrated from hand-rolled HELP_TEXT to citty auto-generated help.

Documentation updates

CLI reference documentation in Starlight now covers the new flags, agent skills have been updated for accurate flag references, and JSON output examples have been corrected to match the actual output shape.

v1.14.3 - June 29, 2026

Multi-package-manager git hooks

Git hooks generated by xtarterize add release/git-hooks now work across npm, yarn, and bun, using the correct command format for each package manager via nypm.

Engine and safety hardening

The minimum Node.js version has been raised to 24 - projects using Node 18–23 now receive a clear error from npm instead of a cryptic runtime failure. Backup collision resolution ensures files with names that could collide in the backup directory (e.g., a/b.js and a__b.js) use a collision-safe encoding scheme. xtarterize undo and xtarterize restore now reject restore operations targeting files outside the project root via path traversal protection.

Detection and dry-run accuracy

Vite plugin dry-run output for tasks like vite-plugin-checker and rollup-plugin-visualizer now matches what xtarterize add actually writes. The detection cache has been improved so config directory changes (.github/, .vscode/, .changeset/) are tracked at the file level, ensuring stale project profiles are invalidated when files within these directories change.

v1.14.2 - June 17, 2026

Edge-case hardening across the entire pipeline - no new features, but significantly improved stability for all commands and surfaces.

CLI resilience improvements

try/catch guards prevent crashes on individual task failures across init, sync, diff, add, doctor, and restore. The --skip/--only flags no longer filter phantom empty-string values, and doctor uses Promise.allSettled for resilient diagnostics when one check fails.

Core stability hardening

Robust error handling for atomic writes with temp file cleanup ensures no orphaned temp files. Schema validation guards against corrupted cache entries. Fixed a React Native + React co-detection issue that returned null. The skipped count now correctly tracks explicit skips from the check phase.

Task reliability fixes

Fixed this.getScripts undefined crash in packageScriptsTask. The commitMsgHook now accepts a package manager parameter instead of hardcoding pnpm. Corrected check() return values for proper conflict vs new status detection.

UI and JSON output fixes

The merged multi-diff view now preserves all diffs instead of dropping earlier ones. The JSON ok field reflects actual conformance state, not intention. Multiselect cancel properly aborts via abortIfCancelled.

create-xtarter-app cross-platform fixes

Windows-compatible path handling, fixed pnpm overrides crash, async readdir replaces sync readdirSync, improved project name sanitization, and proper handling of explicit false CLI flag values.

Documentation corrections

Outdated content refreshed - Node.js minimum bumped to 24, missing --timing and --format flags documented, Rspack added to detected bundlers, task applicability fixed for renovate/lint-staged, and CLI path corrected from apps/cli to apps/xtarterize.

v1.14 - May 29, 2026

Undo command

Interactive add and conformance badges

xtarterize add without a task ID now shows a grouped multi-select menu for interactive task selection. xtarterize check --badge <path> generates an SVG conformance badge with score, progress bar, and status.

Task cleanup and framework gating

Removed editorconfig, nvmrc, and agent/skills tasks - editorconfig is redundant with linters and VS Code settings, nvmrc lts/* is too vague, and agent/skills duplicated AGENTS.md content. The codegen/plop task now requires a detected framework to be applicable.

v1.13 - May 17, 2026

Oxlint and Oxfmt support

Enhanced lint rule coverage

Non-recommended lint rules are now mapped from ESLint configs: eqeqeq, prefer-const, no-shadow, max-params, React rules, and Vitest overrides for Oxlint; noExcessiveCognitiveComplexity and useMaxParams for Biome.

TypeScript config templates

Generated config templates for Biome, Oxlint, Oxfmt, and commitlint now ship with proper TypeScript types.

v1.12 - May 15, 2026

Node.js 24 minimum requirement

The minimum Node.js version has been bumped to 24. Older versions receive a clear error from npm instead of a cryptic runtime failure.

v1.11 - May 13, 2026

Per-task progress indicators

Each task during init and sync now shows a spinner animation at the task level, giving you real-time feedback on what’s being applied. The conformance plan table uses colored status tags (new, patch, skip, conflict) for at-a-glance understanding.

Monorepo dependency management

The workspace flag (-w) is now supported for pnpm dependency installs in monorepo roots, making it easier to manage shared dependencies alongside per-package installs.

v1.10 - May 12, 2026

Unified diff output format

A new --format flag for init, sync, diff, and add commands lets you choose between terminal-friendly and JSON output:

Terminal output
JSON output

Shows +N -M change stats per file and @@ hunk headers in git-style unified diff format.

v1.9 - May 12, 2026

Changeset-aware release workflows

The release workflow task now detects whether your project uses Changesets and generates the appropriate workflow - either changesets/action@v1 for Changesets projects or tag-push for simple versioning.

Automatic Node.js version detection

Node.js version is now auto-detected from .nvmrc and package.json engines.node, ensuring CI and local environments stay in sync.

v1.8 - May 12, 2026

Doctor command

The new doctor command provides environment and project health diagnostics:

Environment

Node version, package manager, OS detection

Tools

Displays installed tool versions (Biome, oxlint, etc.)

Project

Project health checks and diagnostics

Configuration

Config file status and detected settings

Verbose and JSON output modes

The --verbose flag provides detailed system information, and JSON output mode enables machine consumption of diagnostic data.

v1.7 - May 12, 2026

Native package manager auto-updates

The auto-update workflow now uses native package manager commands (pnpm update && pnpm dedupe) instead of npm-check-updates, reducing external dependencies and aligning with package manager best practices.

v1.6 - May 11, 2026

JSONC preservation

Smarter script management

Duplicate scripts with the same command are now skipped automatically during package script management. The "extends": "config:base" format is treated as equivalent to "extends": ["config:base"], and only missing scripts are added - existing scripts are never overwritten.

v1.5 - May 8, 2026

Unified diff format

All dry-run and diff output now uses a consistent git-style patch view across new, modified, and JSON files, providing a uniform review experience regardless of file type.

v1.4 - May 8, 2026

New conformance tasks

Six new conformance tasks expand xtarterize coverage:

EditorConfig

.editorconfig generation for consistent editor settings

npmrc

.npmrc with strict engine checks and exact version pinning

nvmrc

Node version pinning in .nvmrc

lint-staged

Run linters only on staged files - faster pre-commit hooks

Git hooks

Pre-configured git hooks via simple-git-hooks

pnpm catalogs

Workspace catalog: protocol for centralized dependency versions

Optimized skill installation

Skills from the same source repo are now grouped into a single npx command with multiple --skill flags, reducing redundant downloads and setup time.

v1.3 - May 2, 2026

Expanded skills catalog

The agent skills catalog has been expanded to 20+ stack-specific skills:

Frontend / UI

baseline-ui, fixing-accessibility, fixing-metadata, fixing-motion-performance

React

react-dev, react-useeffect

Vue / Nuxt

vue, vue-best-practices, nuxt

Expo / React Native

upgrading-expo, vercel-react-native-skills

Build tools

vite, vitest, tsdown, turborepo

Database / Auth

supabase-postgres-best-practices, postgres-drizzle, redis-best-practices, better-auth-best-practices, create-auth-skill

AI / SDKs

ai-sdk

Specialized

remotion-best-practices

v1.2 - May 1, 2026

Unified JSON diffs

Diffs targeting the same JSON file are now merged into a single unified view instead of separate per-task diffs - see the complete intended state at once.

v1.1 - April 29, 2026

Automatic agent skill installation

Config and CLI improvements

Framework-aware Biome config, Plop templates, and CI workflows are now generated based on your project’s detected stack. The --cwd flag is correctly resolved throughout the full pipeline, and conformance plan and dry-run output are rendered as proper tables.