Known limitations

Emendant prefers a missed result over a false one. These limits are intentional and should be considered when interpreting a clean scan.

Coverage comes from the feed

Emendant reports only breaking changes represented by a curated feed entry. The preview feed currently covers five OpenAI Node SDK v5 changes. An SDK or release absent from the feed cannot produce a finding.

Matching is TypeScript and JavaScript only

Dependency detection understands npm and PyPI projects, but source matching currently supports TypeScript and JavaScript. Python matching and PyPI feed entries are deferred until after the first public release.

Provenance is static

Emendant follows imports, re-exports, constructed values, direct factories, direct function arguments, and statically named object properties. It does not perform full type inference or general flow analysis.

It may decline when code depends on:

• dynamic dependency injection;
• reflection or computed module loading;
• runtime property mutation;
• conflicting factory returns or callers;
• values attributable to more than one package; or
• a binding that is reassigned in an ambiguous way.

Version detection does not guess

• Without a lockfile, a manifest range stays a range.
• If one lockfile contains two relevant installed versions, Emendant does not pick one.
• Only the nearest supported lockfile is used.
• Git, tarball, file, and URL dependencies cannot be placed against registry releases.

These cases produce unknown placements or coverage warnings.

Repository boundaries

Only workspaces declared at the repository root are expanded. A scattered nested manifest is not treated as a separate workspace unless the root package manager declares it.

Global Git excludes, .git/info/exclude, and skip-worktree state are not used because they would make the same commit scan differently on two machines.

Work is capped predictably

Cross-file candidacy is capped at 10% of the source files read, with a floor of 100 files. Very broad shared-client graphs can exceed that budget. Emendant then stops deterministically and emits a coverage warning naming the unexplored work.

The cap is based on files, not elapsed time, so identical repositories produce identical coverage on fast and slow machines.

Generated and unusually large sources are skipped

Known build and dependency directories, minified files, and files over 1,000,000 characters are excluded. If your team maintains generated-looking source by hand, move it out of excluded directories before relying on the scan.