Third-party notices
September 19, 2026 · View on GitHub
dsh-plugin-upgrade ships no bundled third-party code. The published tarball
contains only this repository's source, the packaged skill and its merged version card.
The dependencies below are declared as peerDependencies (the host provides them at
runtime) and as devDependencies (used only to run the test suite in this repository). None
of them is copied into the published artifact.
| Package | Range | Role | License |
|---|---|---|---|
@deepseek-ai/cordis | ^4.0.2 (peer) | Plugin runtime (Context, effect, inject) | Apache-2.0 |
@deepseek-ai/dsh-skill | >=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 (peer) | skills service and SkillRegistry used by the tests | Apache-2.0 |
@deepseek-ai/schemastery | ^3.18.2 (peer) | Config schema | Apache-2.0 |
@deepseek-ai/dsh-skill | 0.1.5-rc.2 (dev) | Real-registry mount test against the published 0.1.5-rc.2 line (the newest published types verify the same merged seam catalog) | Apache-2.0 |
The scanner (lib/scan.mjs) and the CLI import only Node.js built-ins (node:fs,
node:path) and therefore add no transitive install-time dependency of their own.
License texts for the peer packages are distributed by those packages. This repository's own code is Apache-2.0 — see LICENSE.