# Weavatrix Online 0.3.0

Online 0.3.0 is released under the MIT License. The connector, Refactor layer,
and JavaScript engine are now consistently MIT-licensed public packages.

Online 0.3.0 makes the current composition explicit:
`weavatrix-online -> weavatrix-refactor -> weavatrix-js`. The canonical native
`weavatrix` package is an independent offline product; Online and Refactor will
move to Rust in a later release.

## Dependency security ownership

- `refresh_advisories` updates a validated local advisory cache from current
  dependency coordinates.
- `scan_dependency_vulnerabilities` matches the active inventory against that
  cache and returns `NOT_CHECKED` or `PARTIAL` when coverage is missing, stale
  or incomplete.
- `scan_dependency_malware` performs bounded static review of installed
  dependency files. It reports signals for review and never claims that a
  package is compromised or clean.
- The three operations and their implementation are absent from the offline
  Rust and JavaScript packages.

## Composition

- Uses `weavatrix-js ^0.3.15` directly.
- Uses `weavatrix-refactor ^0.1.3`, which also imports only `weavatrix-js`.
- Exposes 52 MCP tools in the complete Online profile without installing the
  old canonical `weavatrix@0.3.14` package.