@vibgrate/cli 2026.729.1 → 2026.729.3

package/dist/{chunk-OIWHR57Q.js → chunk-4BOWWYSE.js}

@@ -1414,9 +1414,11 @@ async function scanOnePackageJson(packageJsonPath, rootDir, npmCache, cache, cat
   });
   const resolved = await Promise.all(metaPromises);
   for (const { pkg, section, spec, meta } of resolved) {
+    const latestSatisfying = meta.stableVersions.length > 0 ? semver26.maxSatisfying(meta.stableVersions, spec) ?? null : null;
     const lockedVersion = lockIndex?.resolve(pkg, spec) ?? null;
-    const registryResolved = meta.stableVersions.length > 0 ? semver26.maxSatisfying(meta.stableVersions, spec) ?? null : null;
-    const resolvedVersion = lockedVersion && semver26.valid(lockedVersion) ? lockedVersion : registryResolved;
+    const range = semver26.validRange(spec);
+    const lockUsable = !!lockedVersion && !!semver26.valid(lockedVersion) && (!range || semver26.satisfies(lockedVersion, range, { includePrerelease: true }));
+    const resolvedVersion = lockUsable ? lockedVersion : latestSatisfying;
     const latestStable2 = meta.latestStableOverall;
     let majorsBehind = null;
     let drift = "unknown";
@@ -1451,6 +1453,7 @@ async function scanOnePackageJson(packageJsonPath, rootDir, npmCache, cache, cat
       currentSpec: spec,
       resolvedVersion,
       latestStable: latestStable2,
+      latestSatisfying,
       majorsBehind,
       drift,
       license: buildDependencyLicense(meta.license, "registry"),
@@ -10404,7 +10407,22 @@ async function runCoreScan(rootDir, opts, advanced) {
     progress.updateStats({ treeSummary: indexedTreeCount });
   }
   progress.completeStep("walk", `${treeCount.totalFiles.toLocaleString()} files indexed`);
-  const nodeProjects = await scanNodeProjects(rootDir, npmCache, fileCache, projectScanTimeoutMs, runtimeCatalog);
+  const nodeProjectsP = scanNodeProjects(rootDir, npmCache, fileCache, projectScanTimeoutMs, runtimeCatalog);
+  const dotnetProjectsP = scanDotnetProjects(rootDir, nugetCache, fileCache, projectScanTimeoutMs, runtimeCatalog);
+  const pythonProjectsP = scanPythonProjects(rootDir, pypiCache, fileCache, projectScanTimeoutMs, runtimeCatalog);
+  const javaProjectsP = scanJavaProjects(rootDir, mavenCache, fileCache, projectScanTimeoutMs, runtimeCatalog);
+  const rubyProjectsP = scanRubyProjects(rootDir, rubygemsCache, fileCache, projectScanTimeoutMs, runtimeCatalog);
+  const swiftProjectsP = scanSwiftProjects(rootDir, swiftCache, fileCache, projectScanTimeoutMs);
+  const goProjectsP = scanGoProjects(rootDir, goCache, fileCache, projectScanTimeoutMs, runtimeCatalog);
+  const rustProjectsP = scanRustProjects(rootDir, cargoCache, fileCache, projectScanTimeoutMs);
+  const phpProjectsP = scanPhpProjects(rootDir, composerCache, fileCache, projectScanTimeoutMs);
+  const dartProjectsP = scanDartProjects(rootDir, pubCache, fileCache, projectScanTimeoutMs);
+  const elixirProjectsP = scanElixirProjects(rootDir, packageManifest, fileCache, projectScanTimeoutMs, offlineMode);
+  const dockerProjectsP = scanDockerProjects(rootDir, packageManifest, fileCache, projectScanTimeoutMs, offlineMode);
+  const helmProjectsP = scanHelmProjects(rootDir, packageManifest, fileCache, projectScanTimeoutMs, offlineMode);
+  const terraformProjectsP = scanTerraformProjects(rootDir, packageManifest, fileCache, projectScanTimeoutMs, offlineMode);
+  const polyglotProjectsP = scanPolyglotProjects(rootDir, fileCache);
+  const nodeProjects = await nodeProjectsP;
   if (nodeProjects.length > 0) {
     progress.insertStepBefore("drift", { id: "node", label: "Found Node projects", weight: 4 });
     progress.startStep("node");
@@ -10416,7 +10434,7 @@ async function runCoreScan(rootDir, opts, advanced) {
     progress.addProjects(nodeProjects.length);
     progress.completeStep("node", `${nodeProjects.length} project${nodeProjects.length !== 1 ? "s" : ""}`, nodeProjects.length);
   }
-  const dotnetProjects = await scanDotnetProjects(rootDir, nugetCache, fileCache, projectScanTimeoutMs, runtimeCatalog);
+  const dotnetProjects = await dotnetProjectsP;
   if (dotnetProjects.length > 0) {
     progress.insertStepBefore("drift", { id: "dotnet", label: "Found .NET projects", weight: 2 });
     progress.startStep("dotnet");
@@ -10428,7 +10446,7 @@ async function runCoreScan(rootDir, opts, advanced) {
     progress.addProjects(dotnetProjects.length);
     progress.completeStep("dotnet", `${dotnetProjects.length} project${dotnetProjects.length !== 1 ? "s" : ""}`, dotnetProjects.length);
   }
-  const pythonProjects = await scanPythonProjects(rootDir, pypiCache, fileCache, projectScanTimeoutMs, runtimeCatalog);
+  const pythonProjects = await pythonProjectsP;
   if (pythonProjects.length > 0) {
     progress.insertStepBefore("drift", { id: "python", label: "Found Python projects", weight: 3 });
     progress.startStep("python");
@@ -10440,7 +10458,7 @@ async function runCoreScan(rootDir, opts, advanced) {
     progress.addProjects(pythonProjects.length);
     progress.completeStep("python", `${pythonProjects.length} project${pythonProjects.length !== 1 ? "s" : ""}`, pythonProjects.length);
   }
-  const javaProjects = await scanJavaProjects(rootDir, mavenCache, fileCache, projectScanTimeoutMs, runtimeCatalog);
+  const javaProjects = await javaProjectsP;
   if (javaProjects.length > 0) {
     progress.insertStepBefore("drift", { id: "java", label: "Found Java projects", weight: 3 });
     progress.startStep("java");
@@ -10452,7 +10470,7 @@ async function runCoreScan(rootDir, opts, advanced) {
     progress.addProjects(javaProjects.length);
     progress.completeStep("java", `${javaProjects.length} project${javaProjects.length !== 1 ? "s" : ""}`, javaProjects.length);
   }
-  const rubyProjects = await scanRubyProjects(rootDir, rubygemsCache, fileCache, projectScanTimeoutMs, runtimeCatalog);
+  const rubyProjects = await rubyProjectsP;
   if (rubyProjects.length > 0) {
     progress.insertStepBefore("drift", { id: "ruby", label: "Found Ruby projects", weight: 2 });
     progress.startStep("ruby");
@@ -10464,7 +10482,7 @@ async function runCoreScan(rootDir, opts, advanced) {
     progress.addProjects(rubyProjects.length);
     progress.completeStep("ruby", `${rubyProjects.length} project${rubyProjects.length !== 1 ? "s" : ""}`, rubyProjects.length);
   }
-  const swiftProjects = await scanSwiftProjects(rootDir, swiftCache, fileCache, projectScanTimeoutMs);
+  const swiftProjects = await swiftProjectsP;
   if (swiftProjects.length > 0) {
     progress.insertStepBefore("drift", { id: "swift", label: "Found Swift projects", weight: 2 });
     progress.startStep("swift");
@@ -10476,7 +10494,7 @@ async function runCoreScan(rootDir, opts, advanced) {
     progress.addProjects(swiftProjects.length);
     progress.completeStep("swift", `${swiftProjects.length} project${swiftProjects.length !== 1 ? "s" : ""}`, swiftProjects.length);
   }
-  const goProjects = await scanGoProjects(rootDir, goCache, fileCache, projectScanTimeoutMs, runtimeCatalog);
+  const goProjects = await goProjectsP;
   if (goProjects.length > 0) {
     progress.insertStepBefore("drift", { id: "go", label: "Found Go projects", weight: 2 });
     progress.startStep("go");
@@ -10488,7 +10506,7 @@ async function runCoreScan(rootDir, opts, advanced) {
     progress.addProjects(goProjects.length);
     progress.completeStep("go", `${goProjects.length} project${goProjects.length !== 1 ? "s" : ""}`, goProjects.length);
   }
-  const rustProjects = await scanRustProjects(rootDir, cargoCache, fileCache, projectScanTimeoutMs);
+  const rustProjects = await rustProjectsP;
   if (rustProjects.length > 0) {
     progress.insertStepBefore("drift", { id: "rust", label: "Found Rust projects", weight: 2 });
     progress.startStep("rust");
@@ -10500,7 +10518,7 @@ async function runCoreScan(rootDir, opts, advanced) {
     progress.addProjects(rustProjects.length);
     progress.completeStep("rust", `${rustProjects.length} project${rustProjects.length !== 1 ? "s" : ""}`, rustProjects.length);
   }
-  const phpProjects = await scanPhpProjects(rootDir, composerCache, fileCache, projectScanTimeoutMs);
+  const phpProjects = await phpProjectsP;
   if (phpProjects.length > 0) {
     progress.insertStepBefore("drift", { id: "php", label: "Found PHP projects", weight: 2 });
     progress.startStep("php");
@@ -10512,7 +10530,7 @@ async function runCoreScan(rootDir, opts, advanced) {
     progress.addProjects(phpProjects.length);
     progress.completeStep("php", `${phpProjects.length} project${phpProjects.length !== 1 ? "s" : ""}`, phpProjects.length);
   }
-  const dartProjects = await scanDartProjects(rootDir, pubCache, fileCache, projectScanTimeoutMs);
+  const dartProjects = await dartProjectsP;
   if (dartProjects.length > 0) {
     progress.insertStepBefore("drift", { id: "dart", label: "Found Dart projects", weight: 2 });
     progress.startStep("dart");
@@ -10524,7 +10542,7 @@ async function runCoreScan(rootDir, opts, advanced) {
     progress.addProjects(dartProjects.length);
     progress.completeStep("dart", `${dartProjects.length} project${dartProjects.length !== 1 ? "s" : ""}`, dartProjects.length);
   }
-  const elixirProjects = await scanElixirProjects(rootDir, packageManifest, fileCache, projectScanTimeoutMs, offlineMode);
+  const elixirProjects = await elixirProjectsP;
   if (elixirProjects.length > 0) {
     progress.insertStepBefore("drift", { id: "elixir", label: "Found Elixir projects", weight: 2 });
     progress.startStep("elixir");
@@ -10536,7 +10554,7 @@ async function runCoreScan(rootDir, opts, advanced) {
     progress.addProjects(elixirProjects.length);
     progress.completeStep("elixir", `${elixirProjects.length} project${elixirProjects.length !== 1 ? "s" : ""}`, elixirProjects.length);
   }
-  const dockerProjects = await scanDockerProjects(rootDir, packageManifest, fileCache, projectScanTimeoutMs, offlineMode);
+  const dockerProjects = await dockerProjectsP;
   if (dockerProjects.length > 0) {
     progress.insertStepBefore("drift", { id: "docker", label: "Found Docker images", weight: 2 });
     progress.startStep("docker");
@@ -10547,7 +10565,7 @@ async function runCoreScan(rootDir, opts, advanced) {
     progress.addProjects(dockerProjects.length);
     progress.completeStep("docker", `${dockerProjects.length} project${dockerProjects.length !== 1 ? "s" : ""}`, dockerProjects.length);
   }
-  const helmProjects = await scanHelmProjects(rootDir, packageManifest, fileCache, projectScanTimeoutMs, offlineMode);
+  const helmProjects = await helmProjectsP;
   if (helmProjects.length > 0) {
     progress.insertStepBefore("drift", { id: "helm", label: "Found Helm charts", weight: 2 });
     progress.startStep("helm");
@@ -10559,7 +10577,7 @@ async function runCoreScan(rootDir, opts, advanced) {
     progress.addProjects(helmProjects.length);
     progress.completeStep("helm", `${helmProjects.length} project${helmProjects.length !== 1 ? "s" : ""}`, helmProjects.length);
   }
-  const terraformProjects = await scanTerraformProjects(rootDir, packageManifest, fileCache, projectScanTimeoutMs, offlineMode);
+  const terraformProjects = await terraformProjectsP;
   if (terraformProjects.length > 0) {
     progress.insertStepBefore("drift", { id: "terraform", label: "Found Terraform configs", weight: 2 });
     progress.startStep("terraform");
@@ -10570,7 +10588,7 @@ async function runCoreScan(rootDir, opts, advanced) {
     progress.addProjects(terraformProjects.length);
     progress.completeStep("terraform", `${terraformProjects.length} project${terraformProjects.length !== 1 ? "s" : ""}`, terraformProjects.length);
   }
-  const polyglotProjects = await scanPolyglotProjects(rootDir, fileCache);
+  const polyglotProjects = await polyglotProjectsP;
   if (polyglotProjects.length > 0) {
     progress.insertStepBefore("drift", { id: "polyglot", label: "Found additional language projects", weight: 2 });
     progress.startStep("polyglot");
@@ -11669,5 +11687,5 @@ async function computeTreeMetadataHash(rootDir, options) {
 }
 
 export { PROJECT_TYPE_TO_OSV_ECOSYSTEM, brandProgressBar, buildVersionTimelines, compactUiPurpose, computeDriftScore, computeRepoFingerprint, computeUpgradeImpact, detectVcs, driftBar, fetchRiskySymbols, fetchScanPreflight, findPackageAnyEcosystem, findPackageTimeline, findVersionCrossings, getChangelogSignals, gitHistoryAvailable, loadConfig, normalizeConstraint, parseDsn, prepareCompressedUpload, projectTypeToVulnEcosystem, resolveHead, resolveRepositoryName, runCoreScan, severityRank, titleBox, versionSatisfies, workingTreeDirty, writeDefaultConfig };
-//# sourceMappingURL=chunk-OIWHR57Q.js.map
-//# sourceMappingURL=chunk-OIWHR57Q.js.map
+//# sourceMappingURL=chunk-4BOWWYSE.js.map
+//# sourceMappingURL=chunk-4BOWWYSE.js.map