Changelog

Package pages have a new Provenance tab showing, per architecture, whether a signed build attestation exists and what it says: the artifact digest, the builder, the source commit it was built from, its resolved dependencies, and whether the signatures check out. The same data is available at /api/pkgs/{name}/attestation.json and through the MCP get_attestation tool.

The score card on every package page now shows the project’s OpenSSF Scorecard aggregate out of 10 on a gauge, and when it was last scored. “See details” opens a panel with who ran the scan, which repository was scored, every check’s own 0–10 score and OpenSSF’s reason for it, each linked to an explanation of the check, plus the link to the result on scorecard.dev where OpenSSF publishes one. Our 0–100 category scores are gone, and the package badge reads openssf scorecard on the same 0–10 scale. Package scores explains where the figure comes from and adds per-check guidance for maintainers, how to get scanned by OpenSSF, and a prompt you can hand to a coding agent.

Packages created or maintained by a Canadian company or developer now carry a maple-leaf badge on their detail page, in the package listing and on the landing page. The same fact is exposed as maintainerCountry in the JSON API and MCP tools, and in each package’s markdown mirror. On the package search, a “Made by Canadians” row in the category filter narrows the listing to those packages (/pkgs/search?cat=canadian), and the MCP search_packages tool accepts category: "canadian" for the same set.

The FAQ on the home page now answers the questions people actually ask about Minimal — whether it is open source, where it runs, and how it differs from Docker and Nix — and every row of the comparison table now explains itself: the info icon beside each feature opens a one-sentence explanation of what it means and how Minimal compares.

Every documentation page now has a plain-markdown mirror at its URL plus .md, the way package pages already do, and /llms-full.txt concatenates the docs, blog and changelog into one document for agents that want all three in a single fetch. The /llms.txt index now lists every docs page and blog post.

A new package scores page explains the score card on every package page: where the OpenSSF Scorecard figure comes from, what the colours mean, and why some packages carry no scorecard at all.

The packages catalog now opens on a landing page with a featured package, a rotating selection of others worth a look, and recent writing on supply chain security. Searching and filtering the full catalog moved to /pkgs/search — the search box in the header goes straight there.

Documentation articles now end with links to the previous and next article, so you can read a section start to finish without going back to the sidebar. They follow the sidebar’s order and carry on across the Start, Concepts, and Reference groups.

Sign in and the catalog’s commit-pinned data opens up: download an SBOM for a package exactly as it was at a past commit, compare a package’s dependencies between two of its versions, and fetch the same snapshots as JSON from the packages API. The endpoints that follow the latest catalog commit stay open to everyone, as before.

T-shirts and other Minimal gear are now available at the Minimal store. The site footer links to it too, so it is easy to find again.

About 125 packages published outside GitHub — the GNU tools and the X11 libraries among them — showed “No description available” on their package pages in the catalog. They now carry a description everywhere the catalog is served, including the JSON API and the markdown mirrors. Where a package’s upstream is not a source repository, the scorecard now explains why no score exists instead of only noting that one is missing.

Packages is out of soft launch: the catalog is linked from the site menu and the footer, and its listing and package detail pages are now search-indexable. Browse versions, advisories, dependencies, and supply-chain scorecards for every package Minimal ships — no account needed.

A new /pkgs/advisories page lists every security advisory affecting the catalog in one table — sortable by severity, affected package, or date, and filterable by severity. It pairs with the advisory feed for subscriptions and the catalog changelog for history.

The catalog changelog at /pkgs/changes can now compare any two commits, not just adjacent ones. Enter a base and target sha to see everything that changed between them — packages added or removed, version bumps, and advisory-count shifts — and share the resulting URL to hand someone the exact comparison.

The catalog is now a Model Context Protocol server. Run claude mcp add --transport http minimal-pkgs https://minimal.dev/api/mcp (or point any MCP client at /api/mcp) to give your agent typed tools for searching packages, reading advisories and SBOMs, inspecting dependencies, and diffing the catalog between commits.

Every package now has a badge you can drop into a README or wiki: ![minimal score](https://minimal.dev/api/pkgs/openssl/badge.svg) shows the package’s Minimal score, and ?metric=advisories shows its active-advisory count. Both stay in sync with the latest catalog data.

The not-found page got a terminal makeover, and a missed package path like /pkgs/opnssl now offers the closest real matches — one click away from openssl.

A new catalog changelog at /pkgs/changes shows what moved between catalog updates — packages added or removed, version bumps, and shifts in advisory counts — so you can track how the catalog evolves.

You can now move through the package catalog without touching the mouse. Press / to jump to search, use j and k to move between packages, and hit Enter to open the highlighted one.

The site footer has been redesigned and the Company page updated to match, making it easier to find your way around and get to know the team behind Minimal.

The documentation now includes a human-readable API reference for the package endpoints, so you can browse what each route returns without reading the raw schema.

The package catalog now speaks agent. An OpenAPI 3.1 description documents the /api/pkgs endpoints, /llms.txt gives AI tools a map of the site, and every package page has a plain-markdown mirror at /pkgs/<name>.md for easy consumption by scripts and LLMs.

Security advisories for catalog packages are now published as an Atom feed, so you can follow new disclosures in your feed reader or wire them into your own tooling.