RepoDNA v1.4.2: Hardening the CLI, Archive Security, and Windows Packaging

RepoDNA v1.4.2 is now available on GitHub!

This is a stability-focused release of my open-source, local-first repository intelligence and code archaeology platform.

Not every meaningful software update needs to introduce a new feature. Sometimes, the most important work happens in dependency management, input validation, command-line behavior, release automation, and regression testing.

That's the focus of RepoDNA v1.4.2.

What is RepoDNA?

RepoDNA helps developers understand software repositories through evidence-backed analysis.

It provides capabilities including:

• Repository structure and language analysis
• Architecture and dependency exploration
• Git history and code archaeology
• Code quality and security signals
• Interactive reports, visualizations, and Project DNA cards
• Local-first analysis through CLI, desktop, and web interfaces

RepoDNA is built primarily with Rust, TypeScript, React, and Tauri.

The goal is to make complex codebases easier to explore without requiring developers to send their source code to a remote service.

What's new in v1.4.2?

1. Improved Windows CLI startup behavior

Previously, launching the portable repodna CLI without arguments could return usage error code 2.

In v1.4.2, launching it without arguments displays the complete command reference and exits successfully.

Invalid options and subcommands still return the appropriate usage error.

This makes the command-line experience more consistent and may also help executable validation in packaging workflows.

2. Stronger archive-extraction security

Handling untrusted archives requires careful validation.

This release updates the core and desktop ZIP dependency lockfiles to version 9.0.4 to address published security advisories affecting the previous version.

Archive entry-name decoding now handles failures explicitly, rejecting malformed names before they reach path sanitization.

Portable ZIP validation also checks for unsafe entries, symbolic links, duplicate names, invalid executable paths, and archive integrity.

These protections reduce the risk of unsafe archive content being accepted during packaging and extraction.

3. Safer Windows packaging

RepoDNA offers both portable CLI builds and desktop installers.

In v1.4.2, WinGet manifest generation validates all four required Windows installer artifacts before writing the manifests.

Previously, a missing or invalid artifact could leave behind incomplete manifest files.

The updated workflow also improves checksum handling for larger installers and verifies executable paths and archive contents more carefully.

The result is stronger protection against incomplete or invalid release packages.

4. Expanded automated testing

Release engineering is not just about building files. It also involves checking what those files actually contain and how they behave.

RepoDNA v1.4.2 adds additional Windows portable ZIP smoke tests covering:

• Portable executable layout
• Binary architecture checks
• CLI startup behavior
• Help and version commands
• Expected exit codes
• Unsafe ZIP entries and missing executables
• Empty or invalid installer artifacts

Windows x64 packages undergo execution-based verification in the supported CI environment.

ARM64 cross-compiled archives receive static validation, while native Windows-on-Arm execution testing remains a future verification step.

The release pipeline also verifies that required Windows MSI and setup EXE artifacts are nonempty.

5. Continued WinGet integration work

The release includes improvements to WinGet package manifest generation for the desktop and command-line distributions.

The intended package identifiers are:

• Sanskar.RepoDNA
• Sanskar.RepoDNA.CLI

WinGet catalog availability depends on Microsoft's separate review and indexing process. GitHub release publication does not automatically mean WinGet installation is available.

Download and try RepoDNA

You can download RepoDNA v1.4.2 for supported platforms from GitHub.

Release: https://github.com/sanskarIN/RepoDNA/releases/tag/v1.4.2

Repository: https://github.com/sanskarIN/RepoDNA

Web application: https://sanskarin.github.io/RepoDNA/

The web version lets you explore RepoDNA without installing the desktop application or command-line tool.

If you prefer command-line tools, you can also install the published npm package:

npm install --global @sanskarin/repodna

Then explore the available commands:

repodna --help

For analysis of a local repository:

repodna analyze .

What's next?

RepoDNA will continue evolving through improvements to analysis quality, platform compatibility, performance, documentation, usability, and release engineering.

Stability and security remain important parts of that development process.

Final thoughts

RepoDNA v1.4.2 is not primarily about adding more buttons or dashboards.

It's about strengthening the foundations that users rely on.

Safer archives, predictable CLI behavior, and more reliable package verification help make the overall developer experience more dependable.

If you work with unfamiliar repositories, maintain open-source projects, or enjoy developer tooling, I'd love for you to explore RepoDNA.

⭐ Star the repository, open an issue, or contribute on GitHub.

GitHub: https://github.com/sanskarIN/RepoDNA

Project website: https://sanskarin.github.io/RepoDNA/

Thanks for supporting open-source development!