What's New in Dino
Release notes and thoughts.
Dino now accounts for the full verification run: what it planned, what ran, what passed, what failed, what could not be verified, and the canonical evidence behind the verdict.
In this issue
- Plan before execution
- Couldn't test is not passed
- One canonical result
- Built for agents, runnable anywhere
Past Dispatches
dino init, now driven by an agent
Headless `dino init`: an autonomous agent or a CI job can configure Dino end to end with zero prompts, one round-trip validation, and machine-readable results.
Read more →Accurate package metadata
Housekeeping: the npm package description and maintainer details now read correctly.
Read more →Linear-time output scanning
A hardening fix: Dino's output leak-check now runs in guaranteed linear time, closing a potential ReDoS flagged by CodeQL.
Read more →Output you can pipe, diff, and trust
Every command now separates the verdict from the noise: clean JSON on stdout, honest exit codes, and a permanent contract that keeps Dino's output machine-readable.
Read more →Onboarding, OAuth2, and REST everywhere
A one-step dino init with authenticated local tests, OAuth2 client-credentials, and full REST coverage across docs, watch, and change tracking.
Read more →Clean scan output
dino scan now prints only your report. Every spinner, notice, and engine log moved to stderr, so piping and redirecting a scan finally do exactly what you expect.
Read more →Dino CLI 1.0
The Dino CLI is now stable and generally available, with a hardened dino login and a committed versioning contract you can pin in CI.
Read more →Dino's one promise
Dino exists to tell you the truth about your API. 0.5.0 is the release where that became the thing everything else answers to.
Read more →The gap where API incidents hide
Most API incidents aren't exotic exploits, they're the slow drift between what your API promises and what it actually does. Here's where that gap hides, and how to close it.
Read more →Documentation Refresh
The docs catch up to REST: docs.usedino.dev and every README rewritten, plus the v0.4.1–v0.4.4 release-pipeline hardening rolled up.
Read more →REST API Scanning
Dino now scans REST end to end: OpenAPI discovery, 19 fuzz strategies across 6 attack surfaces, response validation, and a real --fail-on-high CI gate.
Read more →CLI UX Patch
Fewer mystery failures: dino init warns before a bad URL, and scan timeouts now tell you what to do. Plus the groundwork for REST.
Read more →Rich Terminal UI
An Ink-powered terminal UI with a real design system, an ESM bundle a quarter of the size, and a tag-based release pipeline. Node 22 required.
Read more →Zero-Config Scanning
Point Dino at an endpoint and it just works: resilient introspection, operations generated from the live schema, and clean, pipeable output.
Read more →Socket.dev remediation
A security housekeeping release: four Socket.dev supply-chain findings remediated, and npm audit back to clean.
Read more →First public release
Dino is on npm as @dino-hq/cli. Install it globally, point it at a GraphQL endpoint, and get a real quality report in your terminal.
Read more →