@patchstack/connect 0.2.4 → 0.2.6
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +6 -3
- package/dist/cli.js +597 -24
- package/dist/cli.js.map +1 -1
- package/dist/index.cjs +482 -25
- package/dist/index.cjs.map +1 -1
- package/dist/index.d.cts +11 -3
- package/dist/index.d.ts +11 -3
- package/dist/index.js +478 -22
- package/dist/index.js.map +1 -1
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -2,6 +2,8 @@
|
|
|
2
2
|
|
|
3
3
|
Connect a JavaScript / Node.js application to [Patchstack](https://patchstack.com) for continuous vulnerability monitoring. Scans your `package-lock.json` and reports installed packages so Patchstack can match them against its vulnerability database and notify you when something needs patching.
|
|
4
4
|
|
|
5
|
+
For how this repo fits with the wider Patchstack ecosystem (`saas`, `hub`, `patchstack-website`, `patchstack-connect`), see [`patchstack/saas` → `docs/ecosystem.md`](https://github.com/patchstack/saas/blob/main/docs/ecosystem.md).
|
|
6
|
+
|
|
5
7
|
## Install prompt (for AI coding tools)
|
|
6
8
|
|
|
7
9
|
Copy and paste this prompt into any AI coding assistant (Cursor, v0, Bolt, Lovable, Claude Code, etc.):
|
|
@@ -21,6 +23,7 @@ That's it. The first `scan`:
|
|
|
21
23
|
2. POSTs the package list to Patchstack with **no** UUID.
|
|
22
24
|
3. Patchstack provisions a fresh site and returns its UUID.
|
|
23
25
|
4. The connector writes the UUID to `.patchstackrc.json` so the next `scan` targets the same site.
|
|
26
|
+
5. The connector prints a claim URL — open it in a browser to attach the new site to your Patchstack account. You can re-display it any time with `npx @patchstack/connect status`.
|
|
24
27
|
|
|
25
28
|
Then wire it into builds:
|
|
26
29
|
|
|
@@ -71,7 +74,7 @@ Precedence (highest wins):
|
|
|
71
74
|
Environment variables:
|
|
72
75
|
|
|
73
76
|
- `PATCHSTACK_SITE_UUID` — the site UUID from your Patchstack dashboard
|
|
74
|
-
- `PATCHSTACK_ENDPOINT` — override the API endpoint (default `
|
|
77
|
+
- `PATCHSTACK_ENDPOINT` — override the API endpoint (default `https://api.patchstack.com/monitor/pulse/manifest`)
|
|
75
78
|
- `PATCHSTACK_TIMEOUT_MS` — request timeout in milliseconds (default `30000`)
|
|
76
79
|
|
|
77
80
|
`.patchstackrc.json` example:
|
|
@@ -113,10 +116,10 @@ That's the entire payload. No source code, no environment variables, no file pat
|
|
|
113
116
|
## Supported lockfiles
|
|
114
117
|
|
|
115
118
|
- ✅ `package-lock.json` (npm v6 / v2 / v3) — parsed directly
|
|
119
|
+
- ✅ `pnpm-lock.yaml` (pnpm v5 / v6 / v7 / v8 / v9) — parsed directly
|
|
120
|
+
- ✅ `yarn.lock` (yarn classic v1 and yarn berry v2+) — parsed directly
|
|
116
121
|
- ✅ `bun.lockb` (binary) — package list resolved by walking `node_modules/`
|
|
117
122
|
- ✅ `bun.lock` (text) — same fallback; direct parsing coming
|
|
118
|
-
- ❌ `yarn.lock` — coming soon
|
|
119
|
-
- ❌ `pnpm-lock.yaml` — coming soon
|
|
120
123
|
|
|
121
124
|
If both a Bun lockfile and `node_modules/` are present, the connector walks `node_modules/` to enumerate the installed packages. Run `bun install` (or `npm install`) before scanning so the directory is populated.
|
|
122
125
|
|