dep-check 0.9.1: the org audit read the pre-0.9.0 drift shape

.github/workflows/dep-check.yml

@@ -32,7 +32,7 @@ on:
           TOOL is a semver artifact, so a behaviour change is a version bump somebody reviewed.
           The pin lives here rather than in eleven callers.
         type: string
-        default: '0.9.0'
+        default: '0.9.1'
       run-floor-check:
         description: |
           Also run the suite against the BOTTOM of every declared sibling range, not only

CHANGELOG.md

@@ -8,6 +8,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [dep-check 0.9.1] - 2026-08-27
+
+### Fixed
+
+- The organisation-wide audit labels an `ahead` range the same way check C does. `0.9.0` gave
+  `ceilingDrift` a direction and taught check C to use it, and left the audit reading the old
+  shape — so a published package whose floor sits above `latest` would have printed
+  `(undefined behind)` and been filed under `contract`. Introduced by `0.9.0` and caught before
+  it ran anywhere (#24)
+
+
 ## [dep-check 0.9.0] - 2026-08-27
 
 ### Fixed

packages/dep-check/index.mjs

@@ -290,7 +290,9 @@ async function commandAudit() {
             dep,
             ...drift,
             deprecated: Boolean(manifest.deprecated),
-            severity: field === "peerDependencies" ? "contract" : "behind",
+            // Same three-way severity as check C: a floor above latest means the published
+            // package installs nowhere, which outranks a merely stale contract.
+            severity: drift.direction === "ahead" ? "unpublished" : field === "peerDependencies" ? "contract" : "behind",
           });
         }
       }
@@ -301,7 +303,9 @@ async function commandAudit() {
     title: "audit) every published package in the scope",
     findings,
     note: `  Swept ${names.length} published packages. \`deprecated\` means the registry already warns people.`,
-    columns: (f) => `[${f.severity}]${f.deprecated ? "[deprecated]" : ""} ${f.pkg.padEnd(30)} ${f.field.padEnd(17)} ${f.dep.padEnd(20)} ${f.range.padEnd(16)} latest ${f.latest} (${f.majorsBehind} behind)`,
+    columns: (f) =>
+      `[${f.severity}]${f.deprecated ? "[deprecated]" : ""} ${f.pkg.padEnd(30)} ${f.field.padEnd(17)} ${f.dep.padEnd(20)} ${f.range.padEnd(16)} latest ${f.latest} ` +
+      (f.direction === "ahead" ? "(nothing published satisfies this)" : `(${f.majorsBehind} behind)`),
   });
   return 0;
 }

packages/dep-check/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@theokit/dep-check",
-  "version": "0.9.0",
+  "version": "0.9.1",
   "description": "The ecosystem dependency gate: does a package's declared range still describe the sibling it ships against? Four checks, kept apart by what they need to answer and therefore by whether they may fail a build.",
   "type": "module",
   "engines": {