What's new in Arbor

Full marketing site, admin console, enhanced dashboard, and security hardening.

• NewDedicated /features and /how-it-works pages with interactive diagrams
• NewSecure admin console — triple-layer auth (middleware + server component + API route)
• NewComing Soon modals for unreleased features — no more dead links
• NewArchitecture Health Trends page with blast-score chart and risk distribution
• ImprovedDashboard redesigned with per-repo health bars, personalized greeting, and quick actions
• ImprovedPR comment now includes specific action items ranked by caller count
• SecurityCSP hardened — removed unsafe-eval in production, added X-Frame-Options, Permissions-Policy
• SecurityRate limiter activated on all API routes (was dead code)
• FixedWebhook delivery deduplication edge case where concurrent events could trigger duplicate analyses

Interactive dependency graph visualization and installation token caching.

• NewD3 canvas dependency graph viewer in dashboard — zoom, pan, click nodes
• NewHotspot table with centrality score per file — identifies architectural bottlenecks
• NewInsights page with synthetic graph topology fallback when real data pending
• ImprovedGitHub installation token caching (55-min TTL) — eliminates repeated App JWT roundtrips
• ImprovedAnalysis pipeline latency reduced ~40% by parallelizing clone and graph-build phases
• ImprovedDashboard now uses /analyses/recent endpoint — eliminates N+1 query pattern
• NewSkeleton loading screens and error boundaries on all dashboard pages
• FixedGraphHero canvas flickering on Safari due to missing requestAnimationFrame cleanup

GitHub OAuth dashboard, per-repo history, and blast radius scoring.

• NewGitHub OAuth sign-in via NextAuth v5 — no passwords, scoped to read:user
• NewPer-repo analysis history with full PR metadata and risk timeline
• NewBlast radius score (0–100%) — normalized centrality + caller-count composite
• NewGET /analyses/recent endpoint for cross-repo dashboard aggregation
• NewStripe checkout integration for Pro and Team tiers
• ImprovedPR comment formatting — table now sorted by risk level, with transitive counts
• FixedCORS origin mismatch when Next.js proxy ran on a different port in Docker

Webhook integration, automated PR comments, and Slack notifications.

• NewGitHub App webhook — receives pull_request events and responds 202 immediately
• NewAutomated PR comment posting with risk table and action checklist
• NewGitHub commit status (merge gate) — blocks merge on HIGH risk PRs when enabled
• NewSlack notification integration — posts blast radius summary to any channel
• NewHMAC-SHA256 webhook signature verification
• NewBackground tokio::spawn pipeline — webhook handler never blocks
• ImprovedGraceful shutdown with 10MB body limit and connection draining

Initial public release. Core analysis engine, CLI, and MCP server.

• NewTree-sitter + petgraph blast-radius analysis engine (open source, MIT)
• NewArbor CLI — run graph analysis locally from any terminal
• NewMCP Server — expose call graph data to any LLM that supports the Model Context Protocol
• New14-language support: Rust, TypeScript, JS, Python, Go, Java, C, C++, C#, Kotlin, Swift, Ruby, PHP, Dart
• NewPublished to crates.io as arbor-graph-cli