dependency manifest diff derived

{
  "input": {
    "body": {
      "after": {
        "dependencies": {
          "express": "5.0.0",
          "new-lib": "2.1.0",
          "fast-json": "0.3.0",
          "shared-types": "^1.0.0"
        },
        "devDependencies": {
          "typescript": "5.6.0",
          "shared-types": "1.0.0"
        }
      },
      "before": {
        "dependencies": {
          "express": "4.18.2",
          "fast-json": "0.2.1",
          "retired-lib": "1.4.0",
          "shared-types": "1.0.0"
        },
        "devDependencies": {
          "typescript": "5.5.4"
        }
      }
    },
    "type": "http",
    "method": "POST",
    "bodyType": "json"
  },
  "output": {
    "type": "json",
    "example": {
      "limits": {
        "maxJobs": 200,
        "maxFindings": 500,
        "maxServices": 200,
        "maxResources": 2000,
        "maxVariables": 1000,
        "maxComponents": 5000,
        "maxDependencies": 5000
      },
      "passed": false,
      "changes": [
        {
          "to": "5.0.0",
          "from": "4.18.2",
          "kind": "major",
          "group": "dependencies",
          "dependency": "express",
          "potentially_breaking": true
        },
        {
          "to": "0.3.0",
          "from": "0.2.1",
          "kind": "minor",
          "group": "dependencies",
          "dependency": "fast-json",
          "potentially_breaking": true
        },
        {
          "to": "2.1.0",
          "from": null,
          "kind": "added",
          "group": "dependencies",
          "dependency": "new-lib"
        }
      ],
      "complete": true,
      "findings": [
        {
          "code": "POTENTIALLY_BREAKING_UPGRADE",
          "group": "dependencies",
          "detail": "dependencies.express moved 4.18.2 to 5.0.0, a major change.",
          "dependency": "express"
        },
        {
          "code": "POTENTIALLY_BREAKING_UPGRADE",
          "group": "dependencies",
          "detail": "dependencies.fast-json moved 0.2.1 to 0.3.0, a minor change below 1.0.0, where the convention promises no stability.",
          "dependency": "fast-json"
        },
        {
          "code": "DEPENDENCY_REMOVED",
          "group": "dependencies",
          "detail": "dependencies.retired-lib was removed.",
          "dependency": "retired-lib"
        }
      ],
      "unchanged": false,
      "request_id": "example-request",
      "service_id": "dependency_manifest_diff",
      "added_count": 2,
      "assumptions": [
        "Before 1.0.0 the semantic versioning convention promises no stability, so a 0.x minor change is treated as potentially breaking. Flagging only major bumps would miss the change that breaks most often.",
        "A range changing is a change of what is accepted, not a resolved version moving, and is reported separately.",
        "A dependency moving between a development and a runtime group changes what ships, and is reported even when its version did not move."
      ],
      "limitations": [
        "Manifest comparison only. No registry is contacted, nothing is resolved or installed, and no advisory database is consulted, so this is not a vulnerability report.",
        "unchanged is true only when both manifests were fully compared and nothing moved."
      ],
      "observed_at": "2026-10-02T00:00:00.000Z",
      "not_examined": [],
      "changed_count": 4,
      "finding_count": 6,
      "removed_count": 1,
      "groups_compared": [
        "dependencies",
        "devDependencies",
        "peerDependencies"
      ],
      "service_version": "1.0.0",
      "findings_by_code": {
        "DEPENDENCY_ADDED": 2,
        "DEPENDENCY_REMOVED": 1,
        "SPECIFIER_INTENT_CHANGED": 1,
        "POTENTIALLY_BREAKING_UPGRADE": 2
      },
      "group_change_count": 0,
      "intent_change_count": 1,
      "potentially_breaking_count": 2
    }
  }
}